From cvs at cvs.gnupg.org  Wed Jan  2 01:22:10 2019
From: cvs at cvs.gnupg.org (by Ben McGinnes)
Date: Wed, 02 Jan 2019 01:22:10 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-120-ga0dbdfe
Message-ID: <E1geUIV-0002cg-SD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  a0dbdfebbb60f0d34dd16894803e95221d8be668 (commit)
       via  a2e7c863c821ca035f1e3f8077bdae3b0f81f5eb (commit)
       via  207d4289d84971d11ec1824fbe7d4a2be63b56e4 (commit)
       via  ef9355c2fe8f81ccd73e0ed45ce33e925928f8e1 (commit)
      from  d406471d4bf9c79140e4bc91de7d316ec7465892 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a0dbdfebbb60f0d34dd16894803e95221d8be668
Merge: a2e7c86 d406471
Author: Ben McGinnes <ben at adversary.org>
Date:   Wed Jan 2 11:19:36 2019 +1100

    python docs: post installer
    
    * Merging post installer script.
    * Included ammended Sphinx config file to try to reduce the
      auto-generated EPUB validation failures it produces.
    
    Signed-off-by: Ben McGinnes <ben at adversary.org>


commit a2e7c863c821ca035f1e3f8077bdae3b0f81f5eb
Author: Ben McGinnes <ben at adversary.org>
Date:   Wed Jan 2 11:06:14 2019 +1100

    python: post installer doc fix script
    
    * Got rid of the bash bit in the comments.
    * Made the final printed instructions far more obvious.
    
    Signed-off-by: Ben McGinnes <ben at adversary.org>

diff --git a/lang/python/post_installer.py b/lang/python/post_installer.py
index f711589..b9fd36f 100755
--- a/lang/python/post_installer.py
+++ b/lang/python/post_installer.py
@@ -122,11 +122,6 @@ help:
         @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
 """)
 
-print("""
-You may now generate your preferred documentation format with either Sphinx 
-or Texinfo.
-""")
-
 info_path = os.path.realpath(sysconfig._PREFIX + "/share/info")
 info_paths = os.environ["INFOPATH"].split(":")
 
@@ -141,18 +136,12 @@ for ipath in info_paths:
     else:
         pass
 
-# This will very likely require root or sudo access, so running this script
-# with the same access as used to install the bindings in the first place is
-# highly recommended.
-#
-# bash variant (run in lang/python/doc/texinfo/):
-#
-# for x in *.texi:
-#     makeinfo -v --no-split $x
-# done ;
-#
-# Or to generate HTML:
-#
-# for x in *.texi:
-#     makeinfo -v --no-split --html $x
-# done ;
+print("""
+You may now build your preferred documentation format using either:
+
+ 1. Sphinx in the doc/rst/ directory; and/or
+ 2. Texinfo or Makeinfo in the doc/texinfo/ directory.
+
+Alternatively the original Org mode source files can be found in the doc/src/
+directory.
+""")

commit 207d4289d84971d11ec1824fbe7d4a2be63b56e4
Author: Ben McGinnes <ben at adversary.org>
Date:   Wed Dec 26 11:01:33 2018 +1100

    python: examples
    
    * Fixed inter-edit.py so it will actually work now.
    * made 3 others executable.
    * Fixed the semantics of assuan.py's instructions.
    
    Tested-by: Ben McGinnes <ben at adversary.org>
    Signed-off-by: Ben McGinnes <ben at adversary.org>

diff --git a/lang/python/examples/assuan.py b/lang/python/examples/assuan.py
old mode 100644
new mode 100755
diff --git a/lang/python/examples/decryption-filter.py b/lang/python/examples/decryption-filter.py
old mode 100644
new mode 100755
index 1b04184..d0fc3a4
--- a/lang/python/examples/decryption-filter.py
+++ b/lang/python/examples/decryption-filter.py
@@ -16,10 +16,10 @@
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 """A decryption filter
 
-This demonstrates decryption using gpg3 in three lines of code.  To
+This demonstrates decryption using gpg in three lines of code.  To
 be used like this:
 
-./decryption-filter.py <message.gpg >message.plain
+./decryption-filter.py < message.gpg > message.plain
 
 """
 
diff --git a/lang/python/examples/inter-edit.py b/lang/python/examples/inter-edit.py
old mode 100644
new mode 100755
index f11bb25..2fd74c2
--- a/lang/python/examples/inter-edit.py
+++ b/lang/python/examples/inter-edit.py
@@ -40,10 +40,7 @@ with gpg.Context() as c:
     print("Editing key {} ({}):".format(key.uids[0].uid, key.subkeys[0].fpr))
 
     def edit_fnc(keyword, args):
-        print(
-            "Status: {}, args: {} > ".format(keyword, args),
-            end='',
-            flush=True)
+        print("Status: {}, args: {} > ".format(keyword, args), end="")
 
         if 'GET' not in keyword:
             # no prompt
diff --git a/lang/python/examples/testCMSgetkey.py b/lang/python/examples/testCMSgetkey.py
old mode 100644
new mode 100755

commit ef9355c2fe8f81ccd73e0ed45ce33e925928f8e1
Author: Ben McGinnes <ben at adversary.org>
Date:   Tue Dec 25 00:18:10 2018 +1100

    python: docs processing
    
    * Added some EPUB specific config options to the Sphinx config file
      which might help reduce some of Sphinx's more stupid default errors
      with EPUB validation.
    * Added lang/python/post_installer.py script for automating the
      generation of .texi and .rst "source" files from the real source
      files written in Org mode.  Includes recreating the Sphinx Makefile
      which is excluded due to the m4 toolchain in parent directories, it
      also handles the rewriting of the reST index file properly and
      rewrites the .texi files so they don't impale themselves on Unicode.
    
    Tested-by: Ben McGinnes <ben at adversary.org>
    Signed-off-by: Ben McGinnes <ben at adversary.org>

diff --git a/lang/python/doc/rst/conf.py b/lang/python/doc/rst/conf.py
index 73ecc37..279669d 100644
--- a/lang/python/doc/rst/conf.py
+++ b/lang/python/doc/rst/conf.py
@@ -15,6 +15,8 @@
 # import os
 # import sys
 # sys.path.insert(0, os.path.abspath('.'))
+import hashlib
+import time
 
 
 # -- Project information -----------------------------------------------------
@@ -101,7 +103,7 @@ html_static_path = ['_static']
 # -- Options for HTMLHelp output ---------------------------------------------
 
 # Output file base name for HTML help builder.
-htmlhelp_basename = 'GPGMEPythonBindingsdoc'
+htmlhelp_basename = 'GPGMEPythonBindings'
 
 
 # -- Options for LaTeX output ------------------------------------------------
@@ -114,6 +116,7 @@ latex_elements = {
     # The font size ('10pt', '11pt' or '12pt').
     #
     # 'pointsize': '10pt',
+    'pointsize': '12pt'
 
     # Additional stuff for the LaTeX preamble.
     #
@@ -128,7 +131,8 @@ latex_elements = {
 # (source start file, target name, title,
 #  author, documentclass [howto, manual, or own class]).
 latex_documents = [
-    (master_doc, 'GPGMEPythonBindings.tex', 'GPGME Python Bindings Documentation',
+    (master_doc, 'GPGMEPythonBindings.tex',
+     'GPGME Python Bindings Documentation',
      'The GnuPG Hackers', 'manual'),
 ]
 
@@ -150,8 +154,8 @@ man_pages = [
 #  dir menu entry, description, category)
 texinfo_documents = [
     (master_doc, 'GPGMEPythonBindings', 'GPGME Python Bindings Documentation',
-     author, 'GPGMEPythonBindings', 'One line description of project.',
-     'Miscellaneous'),
+     author, 'GPGMEPythonBindings',
+     'Python Bindings to the GNU Privacy Guard API.', 'Miscellaneous'),
 ]
 
 
@@ -160,14 +164,21 @@ texinfo_documents = [
 # Bibliographic Dublin Core info.
 epub_title = project
 
-# The unique identifier of the text. This can be a ISBN number
+# The unique identifier of the text. This can be an ISBN number
 # or the project homepage.
 #
 # epub_identifier = ''
+epub_identifier = 'org.gnupg.gpgme.python'
 
 # A unique identification for the text.
 #
 # epub_uid = ''
+stt = str(time.time())
+epub_seed = "{0} {1}".format(epub_identifier, tt)
+# SHA1 would be more than fine for this, but since the dimmest always panic
+# about any use of SHA1 with GnuPG, we'll use SHA256.
+epub_hash = hashlib.sha256(epub_seed).hexdigest()
+epub_uid = 'sha256:{0}'.format(epub_hash)
 
 # A list of files that should not be packed into the epub file.
-epub_exclude_files = ['search.html']
\ No newline at end of file
+epub_exclude_files = ['search.html']
diff --git a/lang/python/post_installer.py b/lang/python/post_installer.py
new file mode 100755
index 0000000..f711589
--- /dev/null
+++ b/lang/python/post_installer.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2016-2018 g10 Code GmbH
+# Copyright (C) 2015 Ben McGinnes <ben at adversary.org>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+import glob
+import os
+import os.path
+import shutil
+import subprocess
+import sys
+import sysconfig
+
+from shutil import which
+
+del absolute_import, print_function, unicode_literals
+
+try:
+    emacs = os.path.realpath(which("emacs"))
+except TypeError as e:
+    emacs = None
+
+try:
+    makeinfo = os.path.realpath(which("makeinfo"))
+except TypeError as e:
+    makeinfo = None
+
+try:
+    pandoc = os.path.realpath(which("pandoc"))
+except TypeError as e:
+    pandoc = None
+
+try:
+    texinfo = os.path.realpath(which("texinfo"))
+except TypeError as e:
+    texinfo = None
+
+docsrc = glob.glob('doc/src/**/*', recursive=True)
+
+for srcdoc in docsrc:
+    process = subprocess.Popen([emacs, srcdoc, "--batch", "-f",
+                                "org-texinfo-export-to-texinfo", "--kill"],
+                                stdout=subprocess.PIPE)
+    procom = process.communicate()
+
+doctexi1 = glob.glob('doc/src/**/*.texi', recursive=True)
+doctexi2 = []
+doctexi3 = []
+
+for texi in doctexi1:
+    doctexi2.append(os.path.realpath(texi))
+
+for texdoc in doctexi2:
+    newtex = texdoc.replace("doc/src/", "doc/texinfo/")
+    doctexi3.append(newtex)
+    with open(texdoc, "r") as f:
+        badtex = f.read()
+    goodtex = badtex.replace("@documentencoding UTF-8\n",
+                             "@documentencoding utf-8\n")
+    with open(newtex, "w") as f:
+        f.write(goodtex)
+
+for srcdoc in docsrc:
+    rstdoc = "{0}.rst".format(srcdoc.replace("doc/src/", "doc/rst/"))
+    process = subprocess.Popen([pandoc, "-f", "org", "-t", "rst+smart", "-o",
+                                rstdoc, srcdoc], stdout=subprocess.PIPE)
+    procom = process.communicate()
+
+with open("doc/rst/index.rst", "r") as f:
+    genindex = f.readlines()
+
+indextop = ['.. GPGME Python Bindings documentation master file, created by\n',
+            '   sphinx-quickstart on Wed Dec  5 09:04:47 2018.\n',
+            '   You can adapt this file completely to your liking, but it should at least\n',
+            '   contain the root `toctree` directive.\n', '\n',
+            'GPGME Python Bindings\n', '=====================\n', '\n',
+            '.. toctree::\n', '   :maxdepth: 3\n', '   :caption: Contents:\n',
+            '\n']
+
+with open("doc/rst/index.rst", "w") as f:
+    for line in indextop:
+        f.write(line)
+    for line in genindex[5:]:
+        f.write(line)
+
+with open("doc/rst/Makefile", "w") as f:
+    f.write("""# Minimal makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+SOURCEDIR     = .
+BUILDDIR      = _build
+
+# Put it first so that "make" without argument is like "make help".
+help:
+        @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+.PHONY: help Makefile
+
+# Catch-all target: route all unknown targets to Sphinx using the new
+# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
+%: Makefile
+        @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+""")
+
+print("""
+You may now generate your preferred documentation format with either Sphinx 
+or Texinfo.
+""")
+
+info_path = os.path.realpath(sysconfig._PREFIX + "/share/info")
+info_paths = os.environ["INFOPATH"].split(":")
+
+if info_paths.count(info_path) == 0:
+    info_paths.insert(0, info_path)
+else:
+    pass
+
+for ipath in info_paths:
+    if os.path.exists(os.path.realpath(ipath)) is False:
+        info_paths.remove(ipath)
+    else:
+        pass
+
+# This will very likely require root or sudo access, so running this script
+# with the same access as used to install the bindings in the first place is
+# highly recommended.
+#
+# bash variant (run in lang/python/doc/texinfo/):
+#
+# for x in *.texi:
+#     makeinfo -v --no-split $x
+# done ;
+#
+# Or to generate HTML:
+#
+# for x in *.texi:
+#     makeinfo -v --no-split --html $x
+# done ;

-----------------------------------------------------------------------

Summary of changes:
 lang/python/doc/rst/conf.py   |  23 +++++--
 lang/python/post_installer.py | 147 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 164 insertions(+), 6 deletions(-)
 create mode 100755 lang/python/post_installer.py


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  2 16:16:15 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 02 Jan 2019 16:16:15 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-312-g3d76692
Message-ID: <E1geiFl-0002U9-1q@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3d766924b412b36fc9481803447b93f7fa68b8f6 (commit)
      from  70a8db0333e3c22403b3647f8b5f924f6dace719 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3d766924b412b36fc9481803447b93f7fa68b8f6
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 2 16:15:25 2019 +0100

    doc: Typo fix in code comment
    
    --

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index c87add1..f25a360 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -2538,10 +2538,10 @@ do_setattr (app_t app, const char *name,
 }
 
 
-/* Handle the WRITECERT command for OpenPGP.  This rites the standard
-   certifciate to the card; CERTID needs to be set to "OPENPGP.3".
-   PINCB and PINCB_ARG are the usual arguments for the pinentry
-   callback.  */
+/* Handle the WRITECERT command for OpenPGP.  This writes the standard
+ * certificate to the card; CERTID needs to be set to "OPENPGP.3".
+ * PINCB and PINCB_ARG are the usual arguments for the pinentry
+ * callback.  */
 static gpg_error_t
 do_writecert (app_t app, ctrl_t ctrl,
               const char *certidstr,

-----------------------------------------------------------------------

Summary of changes:
 scd/app-openpgp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  2 20:35:57 2019
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Wed, 02 Jan 2019 20:35:57 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.1-138-g3ee6588
Message-ID: <E1gemJ4-0004ST-6T@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  3ee6588de8311b461ef8707c70ff86d2b252966d (commit)
       via  4871f11745f33c5c5051bfe6f325ac1c10764b04 (commit)
       via  edde61f325e4b345f17c47369f3b6b1400656f04 (commit)
      from  3028a221d39c1b593ea0c1bcbfccd33959769692 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3ee6588de8311b461ef8707c70ff86d2b252966d
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 2 21:25:44 2019 +0200

    Process CCM/EAX/GCM/Poly1305 AEAD cipher modes input in 24 KiB chucks
    
    * cipher/cipher-ccm.c (_gcry_cipher_ccm_encrypt)
    (_gcry_cipher_ccm_decrypt): Process data in 24 KiB chunks.
    * cipher/cipher-eax.c (_gcry_cipher_eax_encrypt)
    (_gcry_cipher_eax_decrypt): Ditto.
    * cipher/cipher-gcm.c (_gcry_cipher_gcm_encrypt)
    (_gcry_cipher_gcm_decrypt): Ditto.
    * cipher/cipher-poly1305.c (_gcry_cipher_poly1305_encrypt)
    (_gcry_cipher_poly1305_decrypt): Ditto.
    --
    
    Patch changes AEAD modes to process input in 24 KiB chuncks to improve
    cache locality when processing large buffers.
    
    Huge buffer test in tests/benchmark show 0.7% improvement for AES-CCM
    and AES-EAX, 6% for AES-GCM and 4% for Chacha20-Poly1305 on Intel Core
    i7-4790K.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/cipher-ccm.c b/cipher/cipher-ccm.c
index e71c6f1..fd284ca 100644
--- a/cipher/cipher-ccm.c
+++ b/cipher/cipher-ccm.c
@@ -319,7 +319,9 @@ _gcry_cipher_ccm_encrypt (gcry_cipher_hd_t c, unsigned char *outbuf,
                           size_t outbuflen, const unsigned char *inbuf,
                           size_t inbuflen)
 {
-  unsigned int burn;
+  gcry_err_code_t err = 0;
+  unsigned int burn = 0;
+  unsigned int nburn;
 
   if (outbuflen < inbuflen)
     return GPG_ERR_BUFFER_TOO_SHORT;
@@ -329,12 +331,32 @@ _gcry_cipher_ccm_encrypt (gcry_cipher_hd_t c, unsigned char *outbuf,
   if (inbuflen > c->u_mode.ccm.encryptlen)
     return GPG_ERR_INV_LENGTH;
 
-  c->u_mode.ccm.encryptlen -= inbuflen;
-  burn = do_cbc_mac (c, inbuf, inbuflen, 0);
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done before encryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for encryption. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      c->u_mode.ccm.encryptlen -= currlen;
+      nburn = do_cbc_mac (c, inbuf, currlen, 0);
+      burn = nburn > burn ? nburn : burn;
+
+      err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen);
+      if (err)
+	break;
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
+
   if (burn)
     _gcry_burn_stack (burn + sizeof(void *) * 5);
-
-  return _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, inbuflen);
+  return err;
 }
 
 
@@ -343,8 +365,9 @@ _gcry_cipher_ccm_decrypt (gcry_cipher_hd_t c, unsigned char *outbuf,
                           size_t outbuflen, const unsigned char *inbuf,
                           size_t inbuflen)
 {
-  gcry_err_code_t err;
-  unsigned int burn;
+  gcry_err_code_t err = 0;
+  unsigned int burn = 0;
+  unsigned int nburn;
 
   if (outbuflen < inbuflen)
     return GPG_ERR_BUFFER_TOO_SHORT;
@@ -354,14 +377,30 @@ _gcry_cipher_ccm_decrypt (gcry_cipher_hd_t c, unsigned char *outbuf,
   if (inbuflen > c->u_mode.ccm.encryptlen)
     return GPG_ERR_INV_LENGTH;
 
-  err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, inbuflen);
-  if (err)
-    return err;
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done after decryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for checksumming. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen);
+      if (err)
+	break;
+
+      c->u_mode.ccm.encryptlen -= currlen;
+      nburn = do_cbc_mac (c, outbuf, currlen, 0);
+      burn = nburn > burn ? nburn : burn;
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
 
-  c->u_mode.ccm.encryptlen -= inbuflen;
-  burn = do_cbc_mac (c, outbuf, inbuflen, 0);
   if (burn)
     _gcry_burn_stack (burn + sizeof(void *) * 5);
-
   return err;
 }
diff --git a/cipher/cipher-eax.c b/cipher/cipher-eax.c
index 3b17bb6..08f815a 100644
--- a/cipher/cipher-eax.c
+++ b/cipher/cipher-eax.c
@@ -48,11 +48,31 @@ _gcry_cipher_eax_encrypt (gcry_cipher_hd_t c,
 	return err;
     }
 
-  err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, inbuflen);
-  if (err != 0)
-    return err;
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done after encryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for checksumming. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen);
+      if (err != 0)
+	return err;
 
-  return _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, outbuf, inbuflen);
+      err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, outbuf,
+			      currlen);
+      if (err != 0)
+	return err;
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
+
+  return 0;
 }
 
 
@@ -75,11 +95,31 @@ _gcry_cipher_eax_decrypt (gcry_cipher_hd_t c,
 	return err;
     }
 
-  err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, inbuf, inbuflen);
-  if (err != 0)
-    return err;
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done before decryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for decryption. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, inbuf,
+			      currlen);
+      if (err != 0)
+	return err;
 
-  return _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, inbuflen);
+      err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen);
+      if (err != 0)
+	return err;
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
+
+  return 0;
 }
 
 
diff --git a/cipher/cipher-gcm.c b/cipher/cipher-gcm.c
index 32ec9fa..f9ddbc5 100644
--- a/cipher/cipher-gcm.c
+++ b/cipher/cipher-gcm.c
@@ -666,11 +666,26 @@ _gcry_cipher_gcm_encrypt (gcry_cipher_hd_t c,
       return GPG_ERR_INV_LENGTH;
     }
 
-  err = gcm_ctr_encrypt(c, outbuf, outbuflen, inbuf, inbuflen);
-  if (err != 0)
-    return err;
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
 
-  do_ghash_buf(c, c->u_mode.gcm.u_tag.tag, outbuf, inbuflen, 0);
+      /* Since checksumming is done after encryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for checksumming. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      err = gcm_ctr_encrypt(c, outbuf, outbuflen, inbuf, currlen);
+      if (err != 0)
+	return err;
+
+      do_ghash_buf(c, c->u_mode.gcm.u_tag.tag, outbuf, currlen, 0);
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
 
   return 0;
 }
@@ -682,6 +697,7 @@ _gcry_cipher_gcm_decrypt (gcry_cipher_hd_t c,
                           const byte *inbuf, size_t inbuflen)
 {
   static const unsigned char zerobuf[MAX_BLOCKSIZE];
+  gcry_err_code_t err;
 
   if (c->spec->blocksize != GCRY_GCM_BLOCK_LEN)
     return GPG_ERR_CIPHER_ALGO;
@@ -711,9 +727,28 @@ _gcry_cipher_gcm_decrypt (gcry_cipher_hd_t c,
       return GPG_ERR_INV_LENGTH;
     }
 
-  do_ghash_buf(c, c->u_mode.gcm.u_tag.tag, inbuf, inbuflen, 0);
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done before decryption, process input in
+       * 24KiB chunks to keep data loaded in L1 cache for decryption. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
 
-  return gcm_ctr_encrypt(c, outbuf, outbuflen, inbuf, inbuflen);
+      do_ghash_buf(c, c->u_mode.gcm.u_tag.tag, inbuf, currlen, 0);
+
+      err = gcm_ctr_encrypt(c, outbuf, outbuflen, inbuf, currlen);
+      if (err)
+	return err;
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
+
+  return 0;
 }
 
 
diff --git a/cipher/cipher-poly1305.c b/cipher/cipher-poly1305.c
index 82537aa..607586b 100644
--- a/cipher/cipher-poly1305.c
+++ b/cipher/cipher-poly1305.c
@@ -164,9 +164,24 @@ _gcry_cipher_poly1305_encrypt (gcry_cipher_hd_t c,
       return GPG_ERR_INV_LENGTH;
     }
 
-  c->spec->stencrypt(&c->context.c, outbuf, (byte*)inbuf, inbuflen);
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done after encryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for checksumming. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      c->spec->stencrypt(&c->context.c, outbuf, (byte*)inbuf, currlen);
 
-  _gcry_poly1305_update (&c->u_mode.poly1305.ctx, outbuf, inbuflen);
+      _gcry_poly1305_update (&c->u_mode.poly1305.ctx, outbuf, currlen);
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
 
   return 0;
 }
@@ -202,9 +217,25 @@ _gcry_cipher_poly1305_decrypt (gcry_cipher_hd_t c,
       return GPG_ERR_INV_LENGTH;
     }
 
-  _gcry_poly1305_update (&c->u_mode.poly1305.ctx, inbuf, inbuflen);
+  while (inbuflen)
+    {
+      size_t currlen = inbuflen;
+
+      /* Since checksumming is done before decryption, process input in 24KiB
+       * chunks to keep data loaded in L1 cache for decryption. */
+      if (currlen > 24 * 1024)
+	currlen = 24 * 1024;
+
+      _gcry_poly1305_update (&c->u_mode.poly1305.ctx, inbuf, currlen);
+
+      c->spec->stdecrypt(&c->context.c, outbuf, (byte*)inbuf, currlen);
+
+      outbuf += currlen;
+      inbuf += currlen;
+      outbuflen -= currlen;
+      inbuflen -= currlen;
+    }
 
-  c->spec->stdecrypt(&c->context.c, outbuf, (byte*)inbuf, inbuflen);
   return 0;
 }
 

commit 4871f11745f33c5c5051bfe6f325ac1c10764b04
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 2 21:25:44 2019 +0200

    tests/benchmark: add Chacha20-Poly1305 benchmarking
    
    * tests/benchmark.c (cipher_bench): Add Chacha20-Poly1305.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/tests/benchmark.c b/tests/benchmark.c
index f9974fc..418f929 100644
--- a/tests/benchmark.c
+++ b/tests/benchmark.c
@@ -825,7 +825,7 @@ cipher_bench ( const char *algoname )
     int doublekey;
   } modes[] = {
     { GCRY_CIPHER_MODE_ECB, "   ECB/Stream", 1, 0xffffffffU },
-    { GCRY_CIPHER_MODE_CBC, "      CBC", 1, 0xffffffffU },
+    { GCRY_CIPHER_MODE_CBC, " CBC/Poly1305", 1, 0xffffffffU },
     { GCRY_CIPHER_MODE_CFB, "      CFB", 0, 0xffffffffU },
     { GCRY_CIPHER_MODE_OFB, "      OFB", 0, 0xffffffffU },
     { GCRY_CIPHER_MODE_CTR, "      CTR", 0, 0xffffffffU },
@@ -840,6 +840,8 @@ cipher_bench ( const char *algoname )
     { GCRY_CIPHER_MODE_EAX, "      EAX", 0, 0xffffffffU,
       NULL, 0, 8, 8 },
     { GCRY_CIPHER_MODE_STREAM, "", 0, 0xffffffffU },
+    { GCRY_CIPHER_MODE_POLY1305, "", 0, 0xffffffffU,
+      NULL, 1, 16, 12 },
     {0}
   };
   int modeidx;
@@ -931,9 +933,14 @@ cipher_bench ( const char *algoname )
   for (modeidx=0; modes[modeidx].mode; modeidx++)
     {
       size_t modekeylen = keylen * (!!modes[modeidx].doublekey + 1);
+      int is_stream = modes[modeidx].mode == GCRY_CIPHER_MODE_STREAM
+                      || modes[modeidx].mode == GCRY_CIPHER_MODE_POLY1305;
 
-      if ((blklen > 1 && modes[modeidx].mode == GCRY_CIPHER_MODE_STREAM)
-          || (blklen == 1 && modes[modeidx].mode != GCRY_CIPHER_MODE_STREAM))
+      if ((blklen > 1 && is_stream) || (blklen == 1 && !is_stream))
+        continue;
+
+      if (modes[modeidx].mode == GCRY_CIPHER_MODE_POLY1305
+          && algo != GCRY_CIPHER_CHACHA20)
         continue;
 
       if (modes[modeidx].req_blocksize > 0

commit edde61f325e4b345f17c47369f3b6b1400656f04
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 2 21:25:44 2019 +0200

    tests/benchmark: add --huge-buffers option for cipher tests
    
    * tests/benchmark.c (huge_buffers, cipher_encrypt, cipher_decrypt): New.
    (cipher_bench): Add 'max_inlen' to modes structure; add huge buffers
    mode selection.
    (main): Add '--huge-buffers'.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/tests/benchmark.c b/tests/benchmark.c
index 59ea32c..f9974fc 100644
--- a/tests/benchmark.c
+++ b/tests/benchmark.c
@@ -37,9 +37,12 @@
 #define PGM "benchmark"
 #include "t-common.h"
 
-/* Do encryption tests with large buffers.  */
+/* Do encryption tests with large buffers (100 KiB).  */
 static int large_buffers;
 
+/* Do encryption tests with huge buffers (256 MiB). */
+static int huge_buffers;
+
 /* Number of cipher repetitions.  */
 static int cipher_repetitions;
 
@@ -743,6 +746,60 @@ static void ccm_aead_init(gcry_cipher_hd_t hd, size_t buflen, int authlen)
 }
 
 
+static gcry_error_t
+cipher_encrypt (gcry_cipher_hd_t h, char *out, size_t outsize,
+		const char *in, size_t inlen, size_t max_inlen)
+{
+  gcry_error_t ret;
+
+  while (inlen)
+    {
+      size_t currlen = inlen;
+
+      if (currlen > max_inlen)
+	currlen = max_inlen;
+
+      ret = gcry_cipher_encrypt(h, out, outsize, in, currlen);
+      if (ret)
+	return ret;
+
+      out += currlen;
+      in += currlen;
+      outsize -= currlen;
+      inlen -= currlen;
+    }
+
+  return 0;
+}
+
+
+static gcry_error_t
+cipher_decrypt (gcry_cipher_hd_t h, char *out, size_t outsize,
+		const char *in, size_t inlen, size_t max_inlen)
+{
+  gcry_error_t ret;
+
+  while (inlen)
+    {
+      size_t currlen = inlen;
+
+      if (currlen > max_inlen)
+	currlen = max_inlen;
+
+      ret = gcry_cipher_decrypt(h, out, outsize, in, currlen);
+      if (ret)
+	return ret;
+
+      out += currlen;
+      in += currlen;
+      outsize -= currlen;
+      inlen -= currlen;
+    }
+
+  return 0;
+}
+
+
 static void
 cipher_bench ( const char *algoname )
 {
@@ -760,34 +817,34 @@ cipher_bench ( const char *algoname )
     int mode;
     const char *name;
     int blocked;
+    unsigned int max_inlen;
     void (* const aead_init)(gcry_cipher_hd_t hd, size_t buflen, int authlen);
     int req_blocksize;
     int authlen;
     int noncelen;
     int doublekey;
   } modes[] = {
-    { GCRY_CIPHER_MODE_ECB, "   ECB/Stream", 1 },
-    { GCRY_CIPHER_MODE_CBC, "      CBC", 1 },
-    { GCRY_CIPHER_MODE_CFB, "      CFB", 0 },
-    { GCRY_CIPHER_MODE_OFB, "      OFB", 0 },
-    { GCRY_CIPHER_MODE_CTR, "      CTR", 0 },
-    { GCRY_CIPHER_MODE_XTS, "      XTS", 0,
+    { GCRY_CIPHER_MODE_ECB, "   ECB/Stream", 1, 0xffffffffU },
+    { GCRY_CIPHER_MODE_CBC, "      CBC", 1, 0xffffffffU },
+    { GCRY_CIPHER_MODE_CFB, "      CFB", 0, 0xffffffffU },
+    { GCRY_CIPHER_MODE_OFB, "      OFB", 0, 0xffffffffU },
+    { GCRY_CIPHER_MODE_CTR, "      CTR", 0, 0xffffffffU },
+    { GCRY_CIPHER_MODE_XTS, "      XTS", 0, 16 << 20,
       NULL, GCRY_XTS_BLOCK_LEN, 0, 0, 1 },
-    { GCRY_CIPHER_MODE_CCM, "      CCM", 0,
-      ccm_aead_init, GCRY_CCM_BLOCK_LEN, 8 },
-    { GCRY_CIPHER_MODE_GCM, "      GCM", 0,
+    { GCRY_CIPHER_MODE_CCM, "      CCM", 0, 0xffffffffU,
+      ccm_aead_init, GCRY_CCM_BLOCK_LEN, 8, },
+    { GCRY_CIPHER_MODE_GCM, "      GCM", 0, 0xffffffffU,
       NULL, GCRY_GCM_BLOCK_LEN, GCRY_GCM_BLOCK_LEN },
-    { GCRY_CIPHER_MODE_OCB, "      OCB", 1,
+    { GCRY_CIPHER_MODE_OCB, "      OCB", 1, 0xffffffffU,
       NULL, 16, 16, 15 },
-    { GCRY_CIPHER_MODE_EAX, "      EAX", 0,
+    { GCRY_CIPHER_MODE_EAX, "      EAX", 0, 0xffffffffU,
       NULL, 0, 8, 8 },
-    { GCRY_CIPHER_MODE_STREAM, "", 0 },
+    { GCRY_CIPHER_MODE_STREAM, "", 0, 0xffffffffU },
     {0}
   };
   int modeidx;
   gcry_error_t err = GPG_ERR_NO_ERROR;
 
-
   if (!algoname)
     {
       for (i=1; i < 400; i++)
@@ -796,7 +853,12 @@ cipher_bench ( const char *algoname )
       return;
     }
 
-  if (large_buffers)
+  if (huge_buffers)
+    {
+      allocated_buflen = 256 * 1024 * 1024;
+      repetitions = 4;
+    }
+  else if (large_buffers)
     {
       allocated_buflen = 1024 * 100;
       repetitions = 10;
@@ -945,14 +1007,16 @@ cipher_bench ( const char *algoname )
             {
               (*modes[modeidx].aead_init) (hd, buflen, modes[modeidx].authlen);
               gcry_cipher_final (hd);
-              err = gcry_cipher_encrypt (hd, outbuf, buflen, buf, buflen);
+              err = cipher_encrypt (hd, outbuf, buflen, buf, buflen,
+				    modes[modeidx].max_inlen);
               if (err)
                 break;
               err = gcry_cipher_gettag (hd, outbuf, modes[modeidx].authlen);
             }
           else
             {
-              err = gcry_cipher_encrypt (hd, outbuf, buflen, buf, buflen);
+              err = cipher_encrypt (hd, outbuf, buflen, buf, buflen,
+				    modes[modeidx].max_inlen);
             }
         }
       stop_timer ();
@@ -1024,7 +1088,8 @@ cipher_bench ( const char *algoname )
             {
               (*modes[modeidx].aead_init) (hd, buflen, modes[modeidx].authlen);
               gcry_cipher_final (hd);
-              err = gcry_cipher_decrypt (hd, outbuf, buflen, buf, buflen);
+              err = cipher_decrypt (hd, outbuf, buflen, buf, buflen,
+				    modes[modeidx].max_inlen);
               if (err)
                 break;
               err = gcry_cipher_checktag (hd, outbuf, modes[modeidx].authlen);
@@ -1034,7 +1099,8 @@ cipher_bench ( const char *algoname )
           else
             {
               gcry_cipher_final (hd);
-              err = gcry_cipher_decrypt (hd, outbuf, buflen, buf, buflen);
+              err = cipher_decrypt (hd, outbuf, buflen, buf, buflen,
+				    modes[modeidx].max_inlen);
             }
         }
       stop_timer ();
@@ -1741,6 +1807,11 @@ main( int argc, char **argv )
           large_buffers = 1;
           argc--; argv++;
         }
+      else if (!strcmp (*argv, "--huge-buffers"))
+        {
+          huge_buffers = 1;
+          argc--; argv++;
+        }
       else if (!strcmp (*argv, "--cipher-repetitions"))
         {
           argc--; argv++;

-----------------------------------------------------------------------

Summary of changes:
 cipher/cipher-ccm.c      |  65 ++++++++++++++++++++-----
 cipher/cipher-eax.c      |  56 ++++++++++++++++++----
 cipher/cipher-gcm.c      |  47 ++++++++++++++++---
 cipher/cipher-poly1305.c |  39 +++++++++++++--
 tests/benchmark.c        | 120 ++++++++++++++++++++++++++++++++++++++---------
 5 files changed, 275 insertions(+), 52 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  3 15:19:27 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 03 Jan 2019 15:19:27 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-314-g405feca
Message-ID: <E1gf3qL-0000J9-CJ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  405feca2bdeeb620dc406667a702035a123ae848 (commit)
       via  cca2b87e79cda212a33c13efdd2b2830295d2efe (commit)
      from  3d766924b412b36fc9481803447b93f7fa68b8f6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 405feca2bdeeb620dc406667a702035a123ae848
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 3 15:18:15 2019 +0100

    scd: Add two variants to the set of ISO7816 functions.
    
    * scd/iso7816.c (iso7816_select_application_ext): New.
    (iso7816_get_data_odd): New.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/iso7816.c b/scd/iso7816.c
index 01faca5..43c0bcd 100644
--- a/scd/iso7816.c
+++ b/scd/iso7816.c
@@ -138,6 +138,21 @@ iso7816_select_application (int slot, const char *aid, size_t aidlen,
 }
 
 
+/* This is the same as iso7816_select_application but may return data
+ * at RESULT,RESULTLEN).  */
+gpg_error_t
+iso7816_select_application_ext (int slot, const char *aid, size_t aidlen,
+                                unsigned int flags,
+                                unsigned char **result, size_t *resultlen)
+{
+  int sw;
+  sw = apdu_send (slot, 0, 0x00, CMD_SELECT_FILE, 4,
+                  (flags&1)? 0:0x0c, aidlen, aid,
+                  result, resultlen);
+  return map_sw (sw);
+}
+
+
 gpg_error_t
 iso7816_select_file (int slot, int tag, int is_dir)
 {
@@ -396,6 +411,70 @@ iso7816_get_data (int slot, int extended_mode, int tag,
 }
 
 
+/* Perform a GET DATA command requesting TAG and storing the result in
+ * a newly allocated buffer at the address passed by RESULT.  Return
+ * the length of this data at the address of RESULTLEN.  This variant
+ * is needed for long (3 octet) tags. */
+gpg_error_t
+iso7816_get_data_odd (int slot, int extended_mode, unsigned int tag,
+                      unsigned char **result, size_t *resultlen)
+{
+  int sw;
+  int le;
+  int datalen;
+  unsigned char data[5];
+
+  if (!result || !resultlen)
+    return gpg_error (GPG_ERR_INV_VALUE);
+  *result = NULL;
+  *resultlen = 0;
+
+  if (extended_mode > 0 && extended_mode < 256)
+    le = 65534; /* Not 65535 in case it is used as some special flag.  */
+  else if (extended_mode > 0)
+    le = extended_mode;
+  else
+    le = 256;
+
+  data[0] = 0x5c;
+  if (tag <= 0xff)
+    {
+      data[1] = 1;
+      data[2] = tag;
+      datalen = 3;
+    }
+  else if (tag <= 0xffff)
+    {
+      data[1] = 2;
+      data[2] = (tag >> 8);
+      data[3] = tag;
+      datalen = 4;
+    }
+  else
+    {
+      data[1] = 3;
+      data[2] = (tag >> 16);
+      data[3] = (tag >> 8);
+      data[4] = tag;
+      datalen = 5;
+    }
+
+  sw = apdu_send_le (slot, extended_mode, 0x00, CMD_GET_DATA + 1,
+                     0x3f, 0xff, datalen, data, le,
+                     result, resultlen);
+  if (sw != SW_SUCCESS)
+    {
+      /* Make sure that pending buffers are released. */
+      xfree (*result);
+      *result = NULL;
+      *resultlen = 0;
+      return map_sw (sw);
+    }
+
+  return 0;
+}
+
+
 /* Perform a PUT DATA command on card in SLOT.  Write DATA of length
    DATALEN to TAG.  EXTENDED_MODE controls whether extended length
    headers or command chaining is used instead of single length
diff --git a/scd/iso7816.h b/scd/iso7816.h
index 4c71bbd..332fc0e 100644
--- a/scd/iso7816.h
+++ b/scd/iso7816.h
@@ -51,6 +51,11 @@ gpg_error_t iso7816_map_sw (int sw);
 gpg_error_t iso7816_select_application (int slot,
                                         const char *aid, size_t aidlen,
                                         unsigned int flags);
+gpg_error_t iso7816_select_application_ext (int slot,
+                                            const char *aid, size_t aidlen,
+                                            unsigned int flags,
+                                            unsigned char **result,
+                                            size_t *resultlen);
 gpg_error_t iso7816_select_file (int slot, int tag, int is_dir);
 gpg_error_t iso7816_select_path (int slot,
                                  const unsigned short *path, size_t pathlen);
@@ -78,6 +83,8 @@ gpg_error_t iso7816_reset_retry_counter_with_rc (int slot, int chvno,
                                                  size_t datalen);
 gpg_error_t iso7816_get_data (int slot, int extended_mode, int tag,
                               unsigned char **result, size_t *resultlen);
+gpg_error_t iso7816_get_data_odd (int slot, int extended_mode, unsigned int tag,
+                                  unsigned char **result, size_t *resultlen);
 gpg_error_t iso7816_put_data (int slot, int extended_mode, int tag,
                               const void *data, size_t datalen);
 gpg_error_t iso7816_put_data_odd (int slot, int extended_mode, int tag,

commit cca2b87e79cda212a33c13efdd2b2830295d2efe
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 3 15:17:04 2019 +0100

    scd: Support "READKEY --advanced" for all cards.
    
    * scd/command.c (cmd_readkey): Reformat for advanced mode.
    --
    
    The --advanced option used to work only if the driver supported that
    but not if we extracted the public key from an x.509 certificate.
    This patch fixes that.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/command.c b/scd/command.c
index 0a96546..9df2611 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -465,7 +465,7 @@ cmd_learn (assuan_context_t ctx, char *line)
 
 

 static const char hlp_readcert[] =
-  "READCERT <hexified_certid>|<keyid>\n"
+  "READCERT <hexified_certid>|<keyid>|<oid>\n"
   "\n"
   "Note, that this function may even be used on a locked card.";
 static gpg_error_t
@@ -498,7 +498,7 @@ cmd_readcert (assuan_context_t ctx, char *line)
 
 
 static const char hlp_readkey[] =
-  "READKEY [--advanced] <keyid>\n"
+  "READKEY [--advanced] <keyid>|<oid>\n"
   "\n"
   "Return the public key for the given cert or key ID as a standard\n"
   "S-expression.\n"
@@ -514,7 +514,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
   unsigned char *cert = NULL;
   size_t ncert, n;
   ksba_cert_t kc = NULL;
-  ksba_sexp_t p;
+  ksba_sexp_t p = NULL;
   unsigned char *pk;
   size_t pklen;
 
@@ -570,13 +570,36 @@ cmd_readkey (assuan_context_t ctx, char *line)
       rc = gpg_error (GPG_ERR_NO_PUBKEY);
       goto leave;
     }
-
   n = gcry_sexp_canon_len (p, 0, NULL, NULL);
-  rc = assuan_send_data (ctx, p, n);
-  xfree (p);
 
+  if (advanced)
+    {
+      gcry_sexp_t s_key;
+
+      rc = gcry_sexp_new (&s_key, (void*)p, n, 0);
+      if (rc)
+        goto leave;
+
+      pklen = gcry_sexp_sprint (s_key, GCRYSEXP_FMT_ADVANCED, NULL, 0);
+      pk = xtrymalloc (pklen);
+      if (!pk)
+        {
+          rc = gpg_error_from_syserror ();
+          goto leave;
+        }
+      log_assert (pklen);
+
+      gcry_sexp_sprint (s_key, GCRYSEXP_FMT_ADVANCED, pk, pklen);
+      gcry_sexp_release (s_key);
+      /* (One less to adjust for the trailing '\0') */
+      rc = assuan_send_data (ctx, pk, pklen-1);
+      xfree (pk);
+    }
+  else
+    rc = assuan_send_data (ctx, p, n);
 
  leave:
+  xfree (p);
   ksba_cert_release (kc);
   xfree (cert);
   return rc;

-----------------------------------------------------------------------

Summary of changes:
 scd/command.c | 35 +++++++++++++++++++++-----
 scd/iso7816.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 scd/iso7816.h |  7 ++++++
 3 files changed, 115 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  4 13:14:07 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 04 Jan 2019 13:14:07 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.33-6-g933bfd7
Message-ID: <E1gfOMa-0005Ul-Kg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  933bfd7b652a907c0d8dd5337c6b5b9cb82ce7b7 (commit)
      from  12349de46d241cfbadbdf99773d6cabfcbc97578 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 933bfd7b652a907c0d8dd5337c6b5b9cb82ce7b7
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 4 13:13:53 2019 +0100

    core: New functions gpgrt_abort and gpgrt_add_emergency_cleanup.
    
    * src/init.c (emergency_cleanup_list): New gloabl var.
    (_gpgrt_add_emergency_cleanup): New.
    (_gpgrt_abort): New. Repalce all calls to abort by this.  Also replace
    all assert by either log_assert or a stderr output followed by a
    _gpgrt_abort.
    (run_emergency_cleanup): New.
    * src/visibility.c (gpgrt_add_emergency_cleanup): New public API.
    (gpgrt_abort): New public API.
    --
    
    Libgcrypt uses its own assert function which makes sure to terminate
    the secure memory.  This is safe as log as an assert is triggered
    internally in Libgcrypt.  GnuPG runs emergency cleanup handlers right
    before log_fatal etc to tell Libgcrypt to terminate the secure memory.
    With the move of the logging function to gpgrt in gnupg 2.3 this did
    not anymore.  Thus we now provide a mechanism in gpgrt to do right
    that.  Eventually Libgcrypt can also make use of this.
    
    What this does not handle are calls to abort or failed asserts in
    external libraries or in libc.  We can't do anything about it in a
    library because a library may not setup signal handlers.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index bd4f975..4779bc0 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,11 @@
 Noteworthy changes in version 1.34 (unreleased) [C25/A25/R_]
 -----------------------------------------------
 
+ * Interface changes relative to the 1.33 release:
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ gpgrt_abort                     NEW.
+ gpgrt_add_emergency_cleanup     NEW.
+
 
 Noteworthy changes in version 1.33 (2018-12-07) [C25/A25/R0]
 -----------------------------------------------
diff --git a/gpgscm/ffi.c b/gpgscm/ffi.c
index 578c68d..2067b0d 100644
--- a/gpgscm/ffi.c
+++ b/gpgscm/ffi.c
@@ -19,7 +19,6 @@
 
 #include <config.h>
 
-#include <assert.h>
 #include <ctype.h>
 #include <dirent.h>
 #include <errno.h>
diff --git a/gpgscm/main.c b/gpgscm/main.c
index 22c7c98..07d8e07 100644
--- a/gpgscm/main.c
+++ b/gpgscm/main.c
@@ -19,7 +19,6 @@
 
 #include <config.h>
 
-#include <assert.h>
 #include <ctype.h>
 #include <errno.h>
 #include <fcntl.h>
diff --git a/gpgscm/scheme.c b/gpgscm/scheme.c
index 906e563..1b489e4 100644
--- a/gpgscm/scheme.c
+++ b/gpgscm/scheme.c
@@ -33,7 +33,6 @@
 # include <math.h>
 #endif
 
-#include <assert.h>
 #include <limits.h>
 #include <stdint.h>
 #include <float.h>
@@ -881,7 +880,7 @@ gc_reservation_failure(struct scheme *sc)
 	  sc->frame_freelist == sc->NIL ? "frame" : "cell",
 	  sc->reserved_lineno);
 #endif
-  abort();
+  _gpgrt_abort();
 }
 
 /* Disable the garbage collection and reserve the given number of
diff --git a/src/estream-printf.c b/src/estream-printf.c
index 2171409..bce6147 100644
--- a/src/estream-printf.c
+++ b/src/estream-printf.c
@@ -89,7 +89,6 @@
 #include <stdarg.h>
 #include <errno.h>
 #include <stddef.h>
-#include <assert.h>
 #if defined(HAVE_INTMAX_T) || defined(HAVE_UINTMAX_T)
 # ifdef HAVE_STDINT_H
 #  include <stdint.h>
@@ -1405,13 +1404,13 @@ do_format (estream_printf_out_t outfnc, void *outfncarg,
       s += arg->length;
       format = s;
 
-      assert (argidx < argspecs_len);
+      gpgrt_assert (argidx < argspecs_len);
       argidx++;
 
       /* Apply indirect field width and precision values.  */
       if (arg->width == STAR_FIELD_VALUE)
         {
-          assert (valuetable[arg->width_pos-1].vt == VALTYPE_INT);
+          gpgrt_assert (valuetable[arg->width_pos-1].vt == VALTYPE_INT);
           arg->width = valuetable[arg->width_pos-1].value.a_int;
           if (arg->width < 0)
             {
@@ -1421,7 +1420,7 @@ do_format (estream_printf_out_t outfnc, void *outfncarg,
         }
       if (arg->precision == STAR_FIELD_VALUE)
         {
-          assert (valuetable[arg->precision_pos-1].vt == VALTYPE_INT);
+          gpgrt_assert (valuetable[arg->precision_pos-1].vt == VALTYPE_INT);
           arg->precision = valuetable[arg->precision_pos-1].value.a_int;
           if (arg->precision < 0)
             arg->precision = NO_FIELD_VALUE;
@@ -1431,13 +1430,13 @@ do_format (estream_printf_out_t outfnc, void *outfncarg,
         value.a_string = strerror (myerrno);
       else
         {
-          assert (arg->vt == valuetable[arg->arg_pos-1].vt);
+          gpgrt_assert (arg->vt == valuetable[arg->arg_pos-1].vt);
           value = valuetable[arg->arg_pos-1].value;
         }
 
       switch (arg->conspec)
         {
-        case CONSPEC_UNKNOWN: assert (!"bug"); break;
+        case CONSPEC_UNKNOWN: gpgrt_assert (!"bug"); break;
 
         case CONSPEC_DECIMAL:
         case CONSPEC_UNSIGNED:
@@ -1864,7 +1863,7 @@ _gpgrt_estream_vasprintf (char **bufp, const char *format, va_list arg_ptr)
       *bufp = NULL;
       return -1;
     }
-  assert (parm.used);   /* We have at least the terminating Nul.  */
+  gpgrt_assert (parm.used);   /* We have at least the terminating Nul.  */
   *bufp = parm.buffer;
   return parm.used - 1; /* Do not include that Nul. */
 }
diff --git a/src/estream.c b/src/estream.c
index 3645dfe..8b7ccc5 100644
--- a/src/estream.c
+++ b/src/estream.c
@@ -84,7 +84,6 @@
 #include <fcntl.h>
 #include <errno.h>
 #include <stddef.h>
-#include <assert.h>
 #ifdef HAVE_W32_SYSTEM
 # ifdef HAVE_WINSOCK2_H
 #  include <winsock2.h>
@@ -653,7 +652,7 @@ func_mem_write (void *cookie, const void *buffer, size_t size)
       mem_cookie->offset = mem_cookie->data_len;
     }
 
-  assert (mem_cookie->memory_size >= mem_cookie->offset);
+  gpgrt_assert (mem_cookie->memory_size >= mem_cookie->offset);
   nleft = mem_cookie->memory_size - mem_cookie->offset;
 
   /* If we are not allowed to grow the buffer, limit the size to the
@@ -698,7 +697,7 @@ func_mem_write (void *cookie, const void *buffer, size_t size)
           return -1;
         }
 
-      assert (mem_cookie->func_realloc);
+      gpgrt_assert (mem_cookie->func_realloc);
       newbuf = mem_cookie->func_realloc (mem_cookie->memory, newsize);
       if (!newbuf)
         return -1;
@@ -706,10 +705,10 @@ func_mem_write (void *cookie, const void *buffer, size_t size)
       mem_cookie->memory = newbuf;
       mem_cookie->memory_size = newsize;
 
-      assert (mem_cookie->memory_size >= mem_cookie->offset);
+      gpgrt_assert (mem_cookie->memory_size >= mem_cookie->offset);
       nleft = mem_cookie->memory_size - mem_cookie->offset;
 
-      assert (size <= nleft);
+      gpgrt_assert (size <= nleft);
     }
 
   memcpy (mem_cookie->memory + mem_cookie->offset, buffer, size);
@@ -776,7 +775,7 @@ func_mem_seek (void *cookie, gpgrt_off_t *offset, int whence)
           return -1;
         }
 
-      assert (mem_cookie->func_realloc);
+      gpgrt_assert (mem_cookie->func_realloc);
       newbuf = mem_cookie->func_realloc (mem_cookie->memory, newsize);
       if (!newbuf)
         return -1;
@@ -1885,7 +1884,7 @@ flush_stream (estream_t stream)
   gpgrt_cookie_write_function_t func_write = stream->intern->func_write;
   int err;
 
-  assert (stream->flags.writing);
+  gpgrt_assert (stream->flags.writing);
 
   if (stream->data_offset)
     {
@@ -1966,7 +1965,7 @@ flush_stream (estream_t stream)
 static void
 es_empty (estream_t stream)
 {
-  assert (!stream->flags.writing);
+  gpgrt_assert (!stream->flags.writing);
   stream->data_len = 0;
   stream->data_offset = 0;
   stream->unread_data_len = 0;
@@ -3556,7 +3555,7 @@ _gpgrt__get_std_stream (int fd)
             {
               fprintf (stderr, "fatal: error creating a dummy estream"
                        " for %d: %s\n", fd, strerror (errno));
-              abort();
+              _gpgrt_abort();
             }
         }
 
diff --git a/src/gpg-error.def.in b/src/gpg-error.def.in
index 0eca3c7..a55b31a 100644
--- a/src/gpg-error.def.in
+++ b/src/gpg-error.def.in
@@ -226,4 +226,7 @@ EXPORTS
 
  gpgrt_w32_override_locale    @173
 
+ gpgrt_add_emergency_cleanup  @174
+ gogrt_abort                  @175
+
 ;; end of file with public symbols for Windows.
diff --git a/src/gpg-error.h.in b/src/gpg-error.h.in
index b7aa5f6..a31fb84 100644
--- a/src/gpg-error.h.in
+++ b/src/gpg-error.h.in
@@ -324,6 +324,12 @@ void gpgrt_get_syscall_clamp (void (**r_pre)(void), void (**r_post)(void));
 /* Register a custom malloc/realloc/free function.  */
 void gpgrt_set_alloc_func  (void *(*f)(void *a, size_t n));
 
+/* Register an emergency cleanup handler.  */
+void gpgrt_add_emergency_cleanup (void (*f)(void));
+
+/* Wrapper around abort to make sure emergency cleanups are run.  */
+void gpgrt_abort (void) GPGRT_ATTR_NORETURN;
+
 
 

 /*
diff --git a/src/gpg-error.vers b/src/gpg-error.vers
index 105e3bb..eef4cbc 100644
--- a/src/gpg-error.vers
+++ b/src/gpg-error.vers
@@ -196,6 +196,9 @@ GPG_ERROR_1.0 {
     gpgrt_fprintf_sf;
     gpgrt_fprintf_sf_unlocked;
 
+    gpgrt_add_emergency_cleanup;
+    gpgrt_abort;
+
   local:
     *;
 };
diff --git a/src/gpgrt-int.h b/src/gpgrt-int.h
index 17244c5..08496b2 100644
--- a/src/gpgrt-int.h
+++ b/src/gpgrt-int.h
@@ -107,6 +107,10 @@ void _gpg_err_set_errno (int err);
 
 gpg_error_t _gpg_err_init (void);
 void _gpg_err_deinit (int mode);
+
+void _gpgrt_add_emergency_cleanup (void (*f)(void));
+void _gpgrt_abort (void) GPGRT_ATTR_NORETURN;
+
 void _gpgrt_set_alloc_func (void *(*f)(void *a, size_t n));
 
 void *_gpgrt_realloc (void *a, size_t n);
diff --git a/src/init.c b/src/init.c
index f104ec4..8ddf0c0 100644
--- a/src/init.c
+++ b/src/init.c
@@ -61,6 +61,20 @@ static void drop_locale_dir (char *locale_dir);
 #endif /*!HAVE_W32_SYSTEM*/
 
 
+/* The list of emergency cleanup functions; see _gpgrt_abort and
+ * _gpgrt_add_emergency_cleanup.  */
+struct emergency_cleanup_item_s;
+typedef struct emergency_cleanup_item_s *emergency_cleanup_item_t;
+struct emergency_cleanup_item_s
+{
+  emergency_cleanup_item_t next;
+  void (*func) (void);
+};
+static emergency_cleanup_item_t emergency_cleanup_list;
+
+
+
+
 /* The realloc function as set by gpgrt_set_alloc_func.  */
 static void *(*custom_realloc)(void *a, size_t n);
 
@@ -106,7 +120,7 @@ _gpg_err_init (void)
       if (tls_index == TLS_OUT_OF_INDEXES)
         {
           /* No way to continue - commit suicide.  */
-          abort ();
+          _gpgrt_abort ();
         }
       _gpg_w32__init_gettext_module ();
       real_init ();
@@ -151,6 +165,67 @@ _gpg_err_deinit (int mode)
 }
 
 
+/* Add the emergency cleanup function F to the list of those function.
+ * If the a function with that address has already been registered, it
+ * is not added a second time.  These emergency functions are called
+ * whenever gpgrt_abort is called and at no other place.  Like signal
+ * handles the emergency cleanup functions shall not call any
+ * non-trivial functions and return as soon as possible.  They allow
+ * to cleanup internal states which should not go into a core dumps or
+ * similar.  This is independent of any atexit functions.  We don't
+ * use locks here because in an emergency case we can't use them
+ * anyway.  */
+void
+_gpgrt_add_emergency_cleanup (void (*f)(void))
+{
+  emergency_cleanup_item_t item;
+
+  for (item = emergency_cleanup_list; item; item = item->next)
+    if (item->func == f)
+      return; /* Function has already been registered.  */
+
+  /* We use a standard malloc here.  */
+  item = malloc (sizeof *item);
+  if (item)
+    {
+      item->func = f;
+      item->next = emergency_cleanup_list;
+      emergency_cleanup_list = item;
+    }
+  else
+    _gpgrt_log_fatal ("out of core in gpgrt_add_emergency_cleanup\n");
+}
+
+
+/* Run the emergency handlers.  No locks are used because we are anyway
+ * in an emergency state.  We also can't release any memory.  */
+static void
+run_emergency_cleanup (void)
+{
+  emergency_cleanup_item_t next;
+  void (*f)(void);
+
+  while (emergency_cleanup_list)
+    {
+      next = emergency_cleanup_list->next;
+      f = emergency_cleanup_list->func;
+      emergency_cleanup_list->func = NULL;
+      emergency_cleanup_list = next;
+      if (f)
+        f ();
+    }
+}
+
+
+/* Wrapper around abort to be able to run all emergency cleanup
+ * functions.  */
+void
+_gpgrt_abort (void)
+{
+  run_emergency_cleanup ();
+  abort ();
+}
+
 
 
 /* Register F as allocation function.  This function is used for all
@@ -503,7 +578,7 @@ get_tls (void)
       if (!tls)
         {
           /* No way to continue - commit suicide.  */
-          abort ();
+          _gpgrt_abort ();
         }
       tls->gt_use_utf8 = 0;
       TlsSetValue (tls_index, tls);
diff --git a/src/logging.c b/src/logging.c
index 01732ca..86cf7c3 100644
--- a/src/logging.c
+++ b/src/logging.c
@@ -46,7 +46,6 @@
 #endif /*!HAVE_W32_SYSTEM*/
 #include <unistd.h>
 #include <fcntl.h>
-#include <assert.h>
 /* #include <execinfo.h> */
 
 #define _GPGRT_NEED_AFLOCAL 1
@@ -690,7 +689,11 @@ _gpgrt_log_get_stream ()
     {
       /* Make sure a log stream has been set.  */
       _gpgrt_log_set_sink (NULL, NULL, -1);
-      assert (logstream);
+      if (!logstream)
+        {
+          fputs ("gpgrt fatal: failed to init log stream\n", stderr);
+          _gpgrt_abort ();
+        }
     }
   return logstream;
 }
@@ -902,7 +905,11 @@ _gpgrt_logv_internal (int level, int ignore_arg_ptr, const char *extrastring,
       /* Make sure a log stream has been set.  */
       _gpgrt_log_set_sink (NULL, NULL, -1);
 #endif
-      assert (logstream);
+      if (!logstream)
+        {
+          fputs ("gpgrt fatal: failed to init log stream\n", stderr);
+          _gpgrt_abort ();
+        }
     }
 
   _gpgrt_flockfile (logstream);
@@ -1038,7 +1045,7 @@ _gpgrt_logv_internal (int level, int ignore_arg_ptr, const char *extrastring,
       /*     for (btidx=0; btidx < btlen; btidx++) */
       /*       log_debug ("[%d] %s\n", btidx, btstr[btidx]); */
       /* } */
-      abort ();
+      _gpgrt_abort ();
     }
   else
     _gpgrt_funlockfile (logstream);
@@ -1136,7 +1143,7 @@ _gpgrt_log_fatal (const char *fmt, ...)
   va_start (arg_ptr, fmt);
   _gpgrt_logv_internal (GPGRT_LOGLVL_FATAL, 0, NULL, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
-  abort (); /* Never called; just to make the compiler happy.  */
+  _gpgrt_abort (); /* Never called; just to make the compiler happy.  */
 }
 
 
@@ -1148,7 +1155,7 @@ _gpgrt_log_bug (const char *fmt, ...)
   va_start (arg_ptr, fmt);
   _gpgrt_logv_internal (GPGRT_LOGLVL_BUG, 0, NULL, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
-  abort (); /* Never called; just to make the compiler happy.  */
+  _gpgrt_abort (); /* Never called; just to make the compiler happy.  */
 }
 
 
@@ -1331,5 +1338,5 @@ _gpgrt__log_assert (const char *expr, const char *file,
   _gpgrt_log (GPGRT_LOGLVL_BUG, "Assertion \"%s\" failed (%s:%d)\n",
            expr, file, line);
 #endif /*!GPGRT_HAVE_MACRO_FUNCTION*/
-  abort (); /* Never called; just to make the compiler happy.  */
+  _gpgrt_abort (); /* Never called; just to make the compiler happy.  */
 }
diff --git a/src/posix-lock.c b/src/posix-lock.c
index b5e6916..be4cc27 100644
--- a/src/posix-lock.c
+++ b/src/posix-lock.c
@@ -33,7 +33,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
-#include <assert.h>
 
 #if USE_POSIX_THREADS
 # include <pthread.h>
@@ -90,8 +89,9 @@ use_pthread_p (void)
           void *retval;
           if (pthread_join (thread, &retval) != 0)
             {
-              assert (!"pthread_join");
-              abort ();
+              fputs ("gpgrt fatal: pthread_join in use_pthread_p failed\n",
+                     stderr);
+              _gpgrt_abort ();
             }
           result = 1;
         }
@@ -110,13 +110,13 @@ get_lock_object (gpgrt_lock_t *lockhd)
 
   if (lock->vers != LOCK_ABI_VERSION)
     {
-      assert (!"lock ABI version");
-      abort ();
+      fputs ("gpgrt fatal: lock ABI version mismatch\n", stderr);
+      _gpgrt_abort ();
     }
   if (sizeof (gpgrt_lock_t) < sizeof (_gpgrt_lock_t))
     {
-      assert (!"sizeof lock obj");
-      abort ();
+      fputs ("gpgrt fatal: sizeof lock obj\n", stderr);
+      _gpgrt_abort ();
     }
 
   return lock;
@@ -136,8 +136,8 @@ _gpgrt_lock_init (gpgrt_lock_t *lockhd)
     {
       if (sizeof (gpgrt_lock_t) < sizeof (_gpgrt_lock_t))
         {
-          assert (!"sizeof lock obj");
-          abort ();
+          fputs ("gpgrt fatal: sizeof lock obj\n", stderr);
+          _gpgrt_abort ();
         }
       lock->vers = LOCK_ABI_VERSION;
     }
diff --git a/src/spawn-posix.c b/src/spawn-posix.c
index 52780a8..7be15ea 100644
--- a/src/spawn-posix.c
+++ b/src/spawn-posix.c
@@ -32,7 +32,6 @@
 #include <stdint.h>
 #include <string.h>
 #include <errno.h>
-#include <assert.h>
 #ifdef HAVE_SIGNAL_H
 # include <signal.h>
 #endif
diff --git a/src/spawn-w32.c b/src/spawn-w32.c
index 4c57756..91f9ac4 100644
--- a/src/spawn-w32.c
+++ b/src/spawn-w32.c
@@ -31,7 +31,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
-#include <assert.h>
 #ifdef HAVE_SIGNAL_H
 # include <signal.h>
 #endif
diff --git a/src/visibility.c b/src/visibility.c
index 573a5a4..d754032 100644
--- a/src/visibility.c
+++ b/src/visibility.c
@@ -80,6 +80,18 @@ gpg_err_deinit (int mode)
   _gpg_err_deinit (mode);
 }
 
+void
+gpgrt_add_emergency_cleanup (void (*f)(void))
+{
+  _gpgrt_add_emergency_cleanup (f);
+}
+
+void
+gpgrt_abort (void)
+{
+  _gpgrt_abort ();
+}
+
 const char *
 gpg_error_check_version (const char *req_version)
 {
@@ -981,7 +993,7 @@ gpgrt_log_fatal (const char *fmt, ...)
   va_start (arg_ptr, fmt);
   _gpgrt_logv (GPGRT_LOGLVL_FATAL, fmt, arg_ptr);
   va_end (arg_ptr);
-  abort (); /* Never called; just to make the compiler happy.  */
+  _gpgrt_abort (); /* Never called; just to make the compiler happy.  */
 }
 
 void
@@ -992,7 +1004,7 @@ gpgrt_log_bug (const char *fmt, ...)
   va_start (arg_ptr, fmt);
   _gpgrt_logv (GPGRT_LOGLVL_BUG, fmt, arg_ptr);
   va_end (arg_ptr);
-  abort (); /* Never called; just to make the compiler happy.  */
+  _gpgrt_abort (); /* Never called; just to make the compiler happy.  */
 }
 
 void
diff --git a/src/visibility.h b/src/visibility.h
index 2dde522..28038d0 100644
--- a/src/visibility.h
+++ b/src/visibility.h
@@ -54,6 +54,8 @@ MARK_VISIBLE (gpg_err_set_errno)
 
 MARK_VISIBLE (gpg_err_init)
 MARK_VISIBLE (gpg_err_deinit)
+MARK_VISIBLE (gpgrt_add_emergency_cleanup)
+MARK_VISIBLE (gpgrt_abort)
 MARK_VISIBLE (gpg_error_check_version)
 MARK_VISIBLE (gpgrt_check_version)
 
@@ -231,6 +233,8 @@ MARK_VISIBLE (gpgrt_cmp_version);
 
 #define gpg_err_init                _gpgrt_USE_UNDERSCORED_FUNCTION
 #define gpg_err_deinit              _gpgrt_USE_UNDERSCORED_FUNCTION
+#define gpgrt_add_emergency_cleanup _gpgrt_USE_UNDERSCORED_FUNCTION
+#define gpgrt_abort                 _gpgrt_USE_UNDERSCORED_FUNCTION
 #define gpg_error_check_version     _gpgrt_USE_UNDERSCORED_FUNCTION
 #define gpgrt_check_version         _gpgrt_USE_OTHER_FUNCTION
 
diff --git a/src/w32-estream.c b/src/w32-estream.c
index 5d29b2c..9e33cdd 100644
--- a/src/w32-estream.c
+++ b/src/w32-estream.c
@@ -28,7 +28,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #ifdef HAVE_SYS_TIME_H
@@ -144,7 +143,7 @@ reader (void *arg)
 	  trace (("%p: got space", ctx));
           EnterCriticalSection (&ctx->mutex);
         }
-      assert (((ctx->writepos + 1) % READBUF_SIZE != ctx->readpos));
+      gpgrt_assert (((ctx->writepos + 1) % READBUF_SIZE != ctx->readpos));
       if (ctx->stop_me)
 	{
           LeaveCriticalSection (&ctx->mutex);
@@ -152,7 +151,7 @@ reader (void *arg)
         }
       nbytes = (ctx->readpos + READBUF_SIZE
 		- ctx->writepos - 1) % READBUF_SIZE;
-      assert (nbytes);
+      gpgrt_assert (nbytes);
       if (nbytes > READBUF_SIZE - ctx->writepos)
 	nbytes = READBUF_SIZE - ctx->writepos;
       LeaveCriticalSection (&ctx->mutex);
@@ -714,7 +713,7 @@ func_w32_pollable_write (void *cookie, const void *buffer, size_t count)
 
   /* If no error occurred, the number of bytes in the buffer must be
      zero.  */
-  assert (!ctx->nbytes);
+  gpgrt_assert (!ctx->nbytes);
 
   if (count > WRITEBUF_SIZE)
     count = WRITEBUF_SIZE;
@@ -881,7 +880,7 @@ _gpgrt_w32_poll (gpgrt_poll_t *fds, size_t nfds, int timeout)
 	{
 	  if (WaitForSingleObject (waitbuf[i], 0) == WAIT_OBJECT_0)
 	    {
-	      assert (waitidx[i] >=0 && waitidx[i] < nfds);
+	      gpgrt_assert (waitidx[i] >=0 && waitidx[i] < nfds);
               /* XXX: What if one wants read and write, is that
                  supported?  */
               if (fds[waitidx[i]].want_read)
diff --git a/src/w32-lock.c b/src/w32-lock.c
index a55f932..feed1e6 100644
--- a/src/w32-lock.c
+++ b/src/w32-lock.c
@@ -44,7 +44,7 @@ get_lock_object (gpgrt_lock_t *lockhd)
   _gpgrt_lock_t *lock = (_gpgrt_lock_t*)lockhd;
 
   if (lock->vers != LOCK_ABI_VERSION)
-    abort ();
+    _gpgrt_abort ();
 
   return lock;
 }
@@ -61,14 +61,14 @@ _gpgrt_lock_init (gpgrt_lock_t *lockhd)
   if (!lock->vers)
     {
       if (sizeof (gpgrt_lock_t) < sizeof (_gpgrt_lock_t))
-        abort ();
+        _gpgrt_abort ();
       lock->vers = LOCK_ABI_VERSION;
     }
   else /* Run the usual check.  */
     {
       lock = get_lock_object (lockhd);
       if (sizeof (gpgrt_lock_t) < sizeof (_gpgrt_lock_t))
-        abort ();
+        _gpgrt_abort ();
     }
 
   InitializeCriticalSection (&lock->csec);

-----------------------------------------------------------------------

Summary of changes:
 NEWS                 |  5 ++++
 gpgscm/ffi.c         |  1 -
 gpgscm/main.c        |  1 -
 gpgscm/scheme.c      |  3 +-
 src/estream-printf.c | 13 ++++-----
 src/estream.c        | 17 ++++++-----
 src/gpg-error.def.in |  3 ++
 src/gpg-error.h.in   |  6 ++++
 src/gpg-error.vers   |  3 ++
 src/gpgrt-int.h      |  4 +++
 src/init.c           | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 src/logging.c        | 21 +++++++++-----
 src/posix-lock.c     | 18 ++++++------
 src/spawn-posix.c    |  1 -
 src/spawn-w32.c      |  1 -
 src/visibility.c     | 16 +++++++++--
 src/visibility.h     |  4 +++
 src/w32-estream.c    |  9 +++---
 src/w32-lock.c       |  6 ++--
 19 files changed, 161 insertions(+), 50 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  7 06:11:48 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 07 Jan 2019 06:11:48 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-315-g5ab3bc4
Message-ID: <E1ggNCY-0002tm-RF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5ab3bc422a5cc1a646c168b547f2b6538b3a4ffa (commit)
      from  405feca2bdeeb620dc406667a702035a123ae848 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5ab3bc422a5cc1a646c168b547f2b6538b3a4ffa
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 7 14:08:51 2019 +0900

    scd: Fix for USB INTERRUPT transfer.
    
    * scd/ccid-driver.c (intr_cb): When LIBUSB_TRANSFER_NO_DEVICE,
    just handle this event as failure.
    
    --
    
    It used to try another interrupt transfer request to make sure
    if it fails again.
    
    GnuPG-bug-id: 4308
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index ff82ef3..c165f6e 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -1470,8 +1470,7 @@ intr_cb (struct libusb_transfer *transfer)
 
   DEBUGOUT_1 ("CCID: interrupt callback %d\n", transfer->status);
 
-  if (transfer->status == LIBUSB_TRANSFER_TIMED_OUT
-      || transfer->status == LIBUSB_TRANSFER_NO_DEVICE)
+  if (transfer->status == LIBUSB_TRANSFER_TIMED_OUT)
     {
       int err;
 

-----------------------------------------------------------------------

Summary of changes:
 scd/ccid-driver.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  7 08:42:47 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 07 Jan 2019 08:42:47 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-2.3.2-7-g7b71a74
Message-ID: <E1ggPYe-0006L3-Fd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  7b71a741b73ba2762f388eee24f94049a67d8559 (commit)
      from  019395666f179b975341dfce76ae3b7a3867b2fe (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7b71a741b73ba2762f388eee24f94049a67d8559
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 7 08:41:59 2019 +0100

    Add translators comment
    
    * src/mail.cpp (Mail::updateCategories_o): Add comment to clarify
    string.
    
    --
    The placeholders there need some explanation.

diff --git a/src/mail.cpp b/src/mail.cpp
index dbb7731..cb87e81 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -2360,6 +2360,13 @@ Mail::updateCategories_o ()
       /* If m_uid addrSpec would not return a result we would never
        * have gotten the UID. */
       int lvl = get_signature_level ();
+
+      /* TRANSLATORS: The first placeholder is for tranlsation of "Level".
+         The second one is for the level number. The third is for the
+         translation of "trust in" and the last one is for the mail
+         address used for verification. The result is used as the
+         text on the green bar for signed mails. e.g.:
+         "GpgOL: Level 3 trust in 'john.doe at example.org'" */
       gpgrt_asprintf (&buf, "GpgOL: %s %i %s '%s'", _("Level"), lvl,
                       _("trust in"),
                       m_uid.addrSpec ().c_str ());

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp | 7 +++++++
 1 file changed, 7 insertions(+)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  7 08:43:19 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 07 Jan 2019 08:43:19 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-2.3.2-9-g796e346
Message-ID: <E1ggPZA-0006bD-8G@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  796e3467dd64cd0b314ad3feba5d4666266c17a6 (commit)
       via  2c4458a371356502c31ed0daf3ff025eceb5b451 (commit)
      from  7b71a741b73ba2762f388eee24f94049a67d8559 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 796e3467dd64cd0b314ad3feba5d4666266c17a6
Merge: 7b71a74 2c4458a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 7 08:43:12 2019 +0100

    Merge remote-tracking branch 'dutch-l10n/dutch'


commit 2c4458a371356502c31ed0daf3ff025eceb5b451
Author: Erwin Bronkhorst <erwinbronkhorst at gmail.com>
Date:   Thu Jan 3 23:16:54 2019 +0100

    Update Dutch translation

diff --git a/po/nl.po b/po/nl.po
index 2ab690b..449196b 100644
--- a/po/nl.po
+++ b/po/nl.po
@@ -8,8 +8,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 2.1.1\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
-"PO-Revision-Date: 2018-09-19 23:00+0200\n"
+"POT-Creation-Date: 2019-01-03 22:51+0100\n"
+"PO-Revision-Date: 2019-01-03 23:12+0100\n"
 "Last-Translator: aheinecke <aheinecke at gnupg.org>\n"
 "Language-Team: English <kde-i18n-doc at kde.org>\n"
 "Language: nl\n"
@@ -83,7 +83,7 @@ msgstr ""
 
 #: src/addin-options.cpp:57
 msgid "&Prefer S/MIME"
-msgstr ""
+msgstr "S/MIME voorkeur geven"
 
 #: src/addin-options.cpp:60
 msgid "Enable or disable any automated key handling."
@@ -142,15 +142,14 @@ msgstr ""
 
 #: src/addin-options.cpp:73
 msgid "Prefer S/MIME over OpenPGP if both are possible."
-msgstr ""
+msgstr "S/MIME de voorkeur geven boven OpenPGP als beiden beschikbaar zijn."
 
 #. TRANSLATORS: Part of the config dialog.
 #: src/addin-options.cpp:76
-#, fuzzy
 msgid ""
 "Search and import &X509 certificates in the configured directory services"
 msgstr ""
-"Klik hier om het certificaat op de geconfigureerde X509 keyserver te zoeken."
+"X509-certificaten in de geconfigureerde mapservices zoeken en imporeren"
 
 #. TRANSLATORS: Part of the config dialog. Tooltip
 #: src/addin-options.cpp:78
@@ -158,6 +157,8 @@ msgid ""
 "Searches for X509 certificates automatically and imports them. This option "
 "searches in all configured services."
 msgstr ""
+"Zoekt automatisch naar X509-certificaten en importeert deze. Deze optie "
+"doorzoekt alle geconfigureerde services."
 
 #. TRANSLATORS: Part of the config dialog. Warning about privacy leak.
 #: src/addin-options.cpp:80
@@ -165,6 +166,8 @@ msgid ""
 "<b>Warning:</b> The configured services will receive information about whom "
 "you send Emails!"
 msgstr ""
+"<b>Waarschuwing:</b> De geconfigureerde services ontvangen informatie over "
+"wie u e-mailberichten stuurt!"
 
 #. TRANSLATORS: Part of address book key configuration dialog.
 #. The contacts name follows.
@@ -257,51 +260,51 @@ msgstr "Sleutels bevestigen"
 #. TRANSLATORS: Part of debugging configuration.
 #: src/addin-options.cpp:121
 msgid "Enable Logging"
-msgstr ""
+msgstr "Logging inschakelen"
 
 #: src/addin-options.cpp:122
 msgid "Default"
-msgstr ""
+msgstr "Standaard"
 
 #. TRANSLATORS: Part of debugging configuration.  The plus should
 #. mean in the combo box that it is added to the above.
 #: src/addin-options.cpp:125
 msgid "+Outlook API calls"
-msgstr ""
+msgstr "+Outlook API-aanroepen"
 
 #. TRANSLATORS: Part of debugging configuration.  The plus should
 #. mean in the combo box that it is added to the above.
 #: src/addin-options.cpp:128
 msgid "+Memory analysis"
-msgstr ""
+msgstr "+Geheugen-analyze"
 
 #. TRANSLATORS: Part of debugging configuration.  The plus should
 #. mean in the combo box that it is added to the above.
 #: src/addin-options.cpp:131
 msgid "+Call tracing"
-msgstr ""
+msgstr "+Aanroepen volgen"
 
 #. TRANSLATORS: Part of debugging configuration.
 #: src/addin-options.cpp:133
 msgid "Log File (required):"
-msgstr ""
+msgstr "Logbestand (verplicht):"
 
 #. TRANSLATORS: Part of debugging configuration.  This is a checkbox
 #. to select if even potentially private data should be included in the
 #. debug log.
 #: src/addin-options.cpp:137
 msgid "Include Mail contents (decrypted!) and meta information."
-msgstr ""
+msgstr "(Versleutelde) inhoud van e-mail en meta-informatie bijvoegen."
 
 #. TRANSLATORS: Dialog title for the log file selection
 #: src/addin-options.cpp:139
 msgid "Select log file"
-msgstr ""
+msgstr "Selecteer logbestand"
 
 #. TRANSLATORS: Part of debugging configuration.
 #: src/addin-options.cpp:141
 msgid "Log level:"
-msgstr ""
+msgstr "Log-niveau:"
 
 #. TRANSLATORS: Part of debugging configuration. Warning shown
 #. in case the highest log level is selected. Please try to
@@ -310,53 +313,51 @@ msgstr ""
 #. level.
 #: src/addin-options.cpp:147
 msgid "<b>Warning:</b> Decreased performance. Huge logs!"
-msgstr ""
+msgstr "<b>Waarschuwing:</b> Verlaagt prestaties. Enorme logbestanden!"
 
 #. TRANSLATORS: Config dialog category for debug options.
 #: src/addin-options.cpp:149
-#, fuzzy
 msgid "Debug"
-msgstr "Debug..."
+msgstr "Debug"
 
 #. TRANSLATORS: Config dialog category for debug options.
 #: src/addin-options.cpp:151
 msgid "Configuaration of debug options"
-msgstr ""
+msgstr "Configuratie van debug-opties"
 
 #. TRANSLATORS: Config dialog debug page, can be technical.
 #: src/addin-options.cpp:153
 msgid "Potential workarounds"
-msgstr ""
+msgstr "Mogelijke tijdelijke oplossingen"
 
 #. TRANSLATORS: Config dialog debug page, can be technical.
 #: src/addin-options.cpp:155
 msgid "Block Outlook during encrypt / sign"
-msgstr ""
+msgstr "Outlook blokkeren tijdens versleutelen / ondertekenen"
 
 #. TRANSLATORS: Config dialog debug page, can be technical.
 #: src/addin-options.cpp:157
 msgid "Block Outlook during decrypt / verify"
-msgstr ""
+msgstr "Outlook blokkeren tijdens ontcijferen / verifi?ren"
 
 #. TRANSLATORS: Config dialog debug page, link to report bug page.
 #: src/addin-options.cpp:159
 msgid "How to report a problem?"
-msgstr ""
+msgstr "Hoe kan ik een probleem rapporteren?"
 
-#: src/categorymanager.cpp:250
-#, fuzzy
+#: src/categorymanager.cpp:253
 msgid "Encrypted Message"
 msgstr "Versleuteld bericht"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
-msgstr ""
+msgstr "Ongewenste e-mail kan niet worden verwerkt"
 
 #. TRANSLATORS: Placeholder for a contact without
 #. a configured name
 #: src/addressbook.cpp:202
 msgid "Unknown contact"
-msgstr ""
+msgstr "Onbekend contact"
 
 #: src/common.cpp:783
 msgid "GpgOL Error"
@@ -399,7 +400,7 @@ msgstr "Het instellingen-scherm voor GpgOL openen"
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -558,17 +559,16 @@ msgstr ""
 "Zie: https://dev.gnupg.org/T3545 voor details."
 
 #: src/mail.cpp:2321
-#, fuzzy
 msgid "Invalid Key"
-msgstr "Ongeldige sleutel gedetecteerd."
+msgstr "Ongeldige sleutel"
 
 #: src/mail.cpp:2363
 msgid "Level"
-msgstr ""
+msgstr "Niveau"
 
 #: src/mail.cpp:2364
 msgid "trust in"
-msgstr ""
+msgstr "vertrouwen in"
 
 #: src/mail.cpp:2592
 msgid "Security Level 4"
@@ -842,11 +842,11 @@ msgstr ""
 "te gebruiken,\n"
 "of stap over naar PGP/Inline in de opties van GpgOL."
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr "Sorry, dat is nog niet mogelijk"
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -870,27 +870,32 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
-msgstr ""
+msgstr "U beantwoordt een niet-ondertekende S/MIME e-mail."
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
-msgstr ""
+msgstr "U stuurt een niet-ondertekende S/MIME e-mail door."
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
 "email and place it in the quote so they can get hold of it.\n"
 "This is why we only allow quoting to be done manually."
 msgstr ""
+"In deze versie van S/MIME kan een aanvaller de ontbrekende handtekening "
+"gebruiken om inhoud van een andere, eventueel volledig ongerelateerde e-"
+"mail, te ontcijferen en in de quote te stoppen om er toegang toe te "
+"krijgen.\n"
+"Dit is waarom we alleen toestaan om handmatig te quoten."
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
-msgstr ""
+msgstr "Kopieer de relevante inhoud en voeg deze toe aan de nieuwe e-mail."
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
@@ -900,7 +905,7 @@ msgstr ""
 "Ze kunnen niet permanent verwijderd worden en zullen de volgende keer dat "
 "dit bericht wordt geopend, weer getoond worden."
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[geen onderwerp]"
 

-----------------------------------------------------------------------

Summary of changes:
 po/nl.po | 93 ++++++++++++++++++++++++++++++++++------------------------------
 1 file changed, 49 insertions(+), 44 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  7 08:44:18 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 07 Jan 2019 08:44:18 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-2.3.2-10-g085ad58
Message-ID: <E1ggPa7-0006cl-SP@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  085ad582eb944625e2e0f56b2569ef3317cf167c (commit)
      from  796e3467dd64cd0b314ad3feba5d4666266c17a6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 085ad582eb944625e2e0f56b2569ef3317cf167c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 7 08:44:07 2019 +0100

    po: Auto update po files
    
    --

diff --git a/po/de.po b/po/de.po
index f46a874..6e1a6f5 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.0.0\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2018-11-12 13:01+0100\n"
 "Last-Translator: aheinecke <aheinecke at gnupg.org>\n"
 "Language-Team: English <kde-i18n-doc at kde.org>\n"
@@ -345,11 +345,11 @@ msgstr "Outlook w?hrend des verschl?sselns / signierens blockieren"
 msgid "How to report a problem?"
 msgstr "Ein Problem berichten?"
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 msgid "Encrypted Message"
 msgstr "Verschl?sselte Nachricht"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr "Junk Mail kann nicht verarbeitet werden"
 
@@ -400,7 +400,7 @@ msgstr "Die Einstellungen von GpgOL ?ffnen"
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -563,105 +563,111 @@ msgstr ""
 msgid "Invalid Key"
 msgstr "Invalider Schl?ssel"
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr "Stufe"
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr "vertrauen in"
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr "Sicherheit Stufe 4"
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr "Vertrauen Stufe 4"
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr "Sicherheit Stufe 3"
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr "Vertrauen Stufe 3"
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr "Sicherheit Stufe 2"
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr "Vertrauen Stufe 2"
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 msgid "Encrypted"
 msgstr "Verschl?sselt"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr "Unsicher"
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 msgid "Signed and encrypted message"
 msgstr "Signierte und verschl?sselte Nachricht"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 msgid "Signed message"
 msgstr "Signierte Nachricht"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 msgid "Encrypted message"
 msgstr "Verschl?sselte Nachricht"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 msgid "Insecure message"
 msgstr "Unsichere Nachricht"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 "Sie k?nnen nicht sicher sein wer die Nachricht gesendet, modifiziert oder "
 "w?hrend der ?bertragung gelesen hat."
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr "Die Nachricht ist signiert aber die ?berpr?fung schlug fehl mit:"
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 msgid "The encryption was VS-NfD-compliant."
 msgstr "Diese Verschl?sselung war VS-NfD-konform."
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "Diese Verschl?sselung war nicht VS-NfD-konform."
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 "Aber Sie k?nnen nicht sicher sein wer der Absender der Nachricht ist da "
 "diese nicht signiert wurde. "
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 msgid "You signed this message."
 msgstr "Sie haben diese Nachricht signiert."
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr "Die Identit?t des Absenders wurde von ihnen selbst beglaubigt."
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr "Der Absender ist berechtigt f?r Sie Identit?ten zu beglaubigen."
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 "Die Identit?t des Absenders wurde von mehreren vertrauensw?rdigen Personen "
 "beglaubigt."
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
@@ -670,17 +676,17 @@ msgstr ""
 "Die Identit?t des Absenders wurde best?tigt von:\n"
 "'%s'\n"
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr "Der Mail-Provider des Empf?ngers lieferte den Schl?ssel."
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 "Einige vertrauensw?rdige Personen haben die Identit?t des Absenders "
 "beglaubigt."
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -692,11 +698,11 @@ msgstr ""
 "Seit %s haben Sie %i Nachrichten an diesen Absender verschl?sselt und %i "
 "Signaturen gepr?ft."
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr "Die Signatur des Absenders wurde das erste mal verifiziert."
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
@@ -706,70 +712,70 @@ msgstr ""
 "Nachrichten von diesem Absender verifiziert und %i Nachrichten verschl?sselt "
 "haben. Seit dem %s."
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr "Aber die Absenderadresse ist nicht vertrauensw?rdig da:"
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr "Die Absenderadresse ist nicht vertrauensw?rdig da:"
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 msgid "The signature is invalid: \n"
 msgstr "Die Signatur ist ung?ltig: \n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr "Beim ?berpr?fen der Signatur ist ein Fehler aufgetreten.\n"
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 msgid "The signature is expired.\n"
 msgstr "Die Signatur ist abgelaufen.\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr "Der verwendete Schl?ssel"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used certificate"
 msgstr "Das verwendete Zertifikat"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 msgid "is not available."
 msgstr "ist nicht verf?gbar."
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr "wurde zur?ckgezogen."
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr "ist veraltet. "
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr "ist nicht zum signieren vorgesehen. "
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr "wurde m?glicherweise zur?ckgezogen."
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 "ist nicht der gleiche Schl?ssel der in der Vergangenheit f?r diese Adresse "
 "verwendet wurde."
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr "passt nicht zu der mailaddresse: \"%s\". "
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr "wurde von keinem vertrauensw?rdigen Schl?ssel beglaubigt."
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
@@ -777,59 +783,59 @@ msgstr ""
 "wurde von keiner vertrauensw?rdigen Zertifizierungsstelle beglaubigt oder "
 "die Zertifizierungsstelle ist unbekannt."
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr "Der Absender hat diese Adresse zur?ckgezogen."
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr "ist als nicht vertrauensw?rdig markiert."
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 msgid "The signature is VS-NfD-compliant."
 msgstr "Die Signatur ist VS-NfD-konform."
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 msgid "The signature is not VS-NfD-compliant."
 msgstr "Die Signatur ist nicht VS-NfD-konform."
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 msgid "The encryption is VS-NfD-compliant."
 msgstr "Diese Verschl?sselung ist VS-NfD-konform."
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "Diese Verschl?sselung ist nicht VS-NfD-konform."
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr "Klicken Sie hier um den Schl?ssel f?r diese Adresse zu ?ndern."
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr "Klicken Sie hier f?r Details zu dem Schl?ssel"
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr "Klicken Sie hier f?r Details zu dem Zertifikat."
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 "Klicken Sie hier um den Schl?ssel auf dem konfigurierten Schl?sselserver zu "
 "suchen. "
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 "Klicken Sie hier um das Zertifikat auf dem konfigurierten X509 "
 "Schl?sselserver zu suchen."
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 msgid "GpgOL: Encryption not possible!"
 msgstr "GpgOL: Verschl?sselung nicht m?glich!"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -845,11 +851,11 @@ msgstr ""
 "Wenn es weiterhin fehlschl?gt k?nnten Sie ihre daten gegebenenfalls \n"
 "als verschl?sselten Anhang anh?ngen."
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr "Sorry, dies ist leider noch nicht m?glich"
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -873,15 +879,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr "Sie antworten einer unsignierten S/MIME Mail."
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr "Sie leiten eine unsignierte S/MIME email weiter. "
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -894,13 +900,13 @@ msgstr ""
 "zug?nglich.\n"
 "Aus diesem Grund erlauben wir in diesem Fall nur manuelles zitieren."
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 "Bitte kopieren Sie die relevanten Inhalte und f?gen diese in die neue Mail "
 "ein."
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
@@ -910,7 +916,7 @@ msgstr ""
 "Sie k?nnen nicht permanent entfernt werden und werden beim n?chsten ?ffnen "
 "dieser Nachricht wieder angezeigt."
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[Kein Betreff]"
 
diff --git a/po/fr.po b/po/fr.po
index d3695e8..031ed50 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2015-10-01 17:05+0200\n"
 "Last-Translator: Olivier Serve <olivier.serve at atos.net>\n"
 "Language-Team: French <kde-i18n-doc at kde.org>\n"
@@ -323,12 +323,12 @@ msgstr ""
 msgid "How to report a problem?"
 msgstr ""
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 #, fuzzy
 msgid "Encrypted Message"
 msgstr "D?chiffrer le message"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr ""
 
@@ -380,7 +380,7 @@ msgstr ""
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -520,122 +520,128 @@ msgstr ""
 msgid "Invalid Key"
 msgstr ""
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr ""
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr ""
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 #, fuzzy
 msgid "Encrypted"
 msgstr "Chiffrer"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 #, fuzzy
 msgid "Signed message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 #, fuzzy
 msgid "Encrypted message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 #, fuzzy
 msgid "Insecure message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr ""
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 #, fuzzy
 msgid "The encryption was VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 #, fuzzy
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 #, fuzzy
 msgid "You signed this message."
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr ""
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -643,142 +649,142 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 #, fuzzy
 msgid "The used certificate"
 msgstr "Erreur de v?rification"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 #, fuzzy
 msgid "is not available."
 msgstr "La liste de r?vocation (CRL) n'est pas disponible\n"
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
 msgstr ""
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 #, fuzzy
 msgid "The signature is VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 #, fuzzy
 msgid "The signature is not VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 #, fuzzy
 msgid "The encryption is VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 #, fuzzy
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 #, fuzzy
 msgid "GpgOL: Encryption not possible!"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -788,11 +794,11 @@ msgid ""
 "switching to PGP/Inline in GpgOL's options."
 msgstr ""
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -806,15 +812,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -822,18 +828,18 @@ msgid ""
 "This is why we only allow quoting to be done manually."
 msgstr ""
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
 "message is opened."
 msgstr ""
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[pas de sujet]"
 
diff --git a/po/nl.po b/po/nl.po
index 449196b..22ead69 100644
--- a/po/nl.po
+++ b/po/nl.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 2.1.1\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2019-01-03 22:51+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2019-01-03 23:12+0100\n"
 "Last-Translator: aheinecke <aheinecke at gnupg.org>\n"
 "Language-Team: English <kde-i18n-doc at kde.org>\n"
@@ -562,105 +562,111 @@ msgstr ""
 msgid "Invalid Key"
 msgstr "Ongeldige sleutel"
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr "Niveau"
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr "vertrouwen in"
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr "Veiligheidsniveau 4"
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr "Vertrouwensniveau 4"
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr "Veiligheidsniveau 3"
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr "Vertrouwensniveau 3"
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr "Veiligheidsniveau 2"
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr "Vertrouwensniveau 2"
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 msgid "Encrypted"
 msgstr "Versleuteld"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr "Onveilig"
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 msgid "Signed and encrypted message"
 msgstr "Ondertekend en versleuteld bericht"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 msgid "Signed message"
 msgstr "Ondertekend bericht"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 msgid "Encrypted message"
 msgstr "Versleuteld bericht"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 msgid "Insecure message"
 msgstr "Onveilig bericht"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 "Het is niet zeker wie het bericht heeft verzonden of onderweg aangepast of "
 "gelezen heeft."
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr "Het bericht is ondertekend, maar de verificatie is mislukt met:"
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 msgid "The encryption was VS-NfD-compliant."
 msgstr "De versleuteling is conform VS-NfD."
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "De versleuteling is niet conform VS-NfD."
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 "Het is niet zeker wie dit bericht heeft verzonden omdat het niet is "
 "ondertekend"
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 msgid "You signed this message."
 msgstr "U heeft dit bericht ondertekend."
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr "De identiteit van de verzender is door uzelf gecertificeerd."
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr "De verzender heeft toestemming om identiteiten voor u te certificeren."
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 "De identiteit van de verzender is gecertificeerd door verschillende "
 "vertrouwde mensen."
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
@@ -670,17 +676,17 @@ msgstr ""
 "verlener:\n"
 "'%s'\n"
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr "De e-mailprovider van de ontvanger heeft deze sleutel aangeboden."
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 "Enkele vertrouwde personen hebben de identiteit van de verzender "
 "gecertificeerd."
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -691,11 +697,11 @@ msgstr ""
 "geschiedenis heb opgebouwd met dit adres vanaf %s.\n"
 "U heeft sindsdien %i berichten versleuteld en %i berichten geverifieerd."
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr "De handtekening van de verzender is voor het eerst geverifieerd."
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
@@ -704,70 +710,70 @@ msgstr ""
 "Het adres van de verzender is nog niet betrouwbaar omdat u nog maar %i "
 "berichten heeft geverifieerd en %i berichten heeft versleuteld sinds %s."
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr "Maar het adres van de verzender is niet betrouwbaar vanwege:"
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr "Het adres van de verzender is niet betrouwbaar vanwege:"
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 msgid "The signature is invalid: \n"
 msgstr "De handtekening is ongeldig:\n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr "Fout bij het verifi?ren van de handtekening.\n"
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 msgid "The signature is expired.\n"
 msgstr "De handtekening is verlopen.\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr "De gebruikte sleutel"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used certificate"
 msgstr "Het gebruikte certificaat"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 msgid "is not available."
 msgstr "is niet beschikbaar."
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr "is ingetrokken."
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr "is verlopen."
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr "is niet bedoeld voor ondertekening."
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr "kan niet worden geverifieerd op intrekking."
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 "is niet dezelfde als de sleutel die in het verleden voor dit adres is "
 "gebruikt."
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr "claimt het adres: \"%s\" niet."
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr "is niet certificeerd door een betrouwbare sleutel."
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
@@ -775,56 +781,56 @@ msgstr ""
 "is niet gecertificeerd door een betrouwbare certificeringsinstantie of de "
 "certificeringsinstantie is onbekend."
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr "De verzender heeft dit adres als ingetrokken gemarkeerd."
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr "is gemarkeerd als onbetrouwbaar."
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 msgid "The signature is VS-NfD-compliant."
 msgstr "De handtekening is conform VS-NfD."
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 msgid "The signature is not VS-NfD-compliant."
 msgstr "De handtekening is niet conform VS-NfD."
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 msgid "The encryption is VS-NfD-compliant."
 msgstr "De versleuteling is conform VS-NfD."
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "De versleuteling is niet conform VS-NfD."
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr "Klik hier om de sleutel voor dit adres te wijzigen."
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr "Klik hier voor details over de sleutel."
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr "Klik hier voor details over het certificaat."
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr "Klik hier om de sleutel op de geconfigureerde keyserver te zoeken."
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 "Klik hier om het certificaat op de geconfigureerde X509 keyserver te zoeken."
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 msgid "GpgOL: Encryption not possible!"
 msgstr "GpgOL: Versleutelen niet mogelijk!"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
diff --git a/po/pt.po b/po/pt.po
index cd045f2..c1af2af 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.1.1\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2018-10-09 16:56+0100\n"
 "Last-Translator: Marco A.G.Pinto <marcoagpinto at sapo.pt>\n"
 "Language-Team: Portuguese <kde-i18n-doc at kde.org>\n"
@@ -344,12 +344,12 @@ msgstr "Bloquear o Outlook durante a desencripta??o / verifica??o"
 msgid "How to report a problem?"
 msgstr "Como relatar um problema?"
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 #, fuzzy
 msgid "Encrypted Message"
 msgstr "Mensagem encriptada"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr ""
 
@@ -400,7 +400,7 @@ msgstr "Abrir o di?logo de defini??es para o GpgOL"
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -564,104 +564,110 @@ msgstr ""
 msgid "Invalid Key"
 msgstr "Chave inv?lida detetada."
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 #, fuzzy
 msgid "Level"
 msgstr "N?vel de log:"
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr ""
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr "N?vel de seguran?a 4"
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr "N?vel de Confian?a 4"
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr "N?vel de Seguran?a 3"
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr "N?vel de Confian?a 3"
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr "N?vel de Seguran?a 2"
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr "N?vel de Confian?a 2"
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 msgid "Encrypted"
 msgstr "Encriptada"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr "Insegura"
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 msgid "Signed and encrypted message"
 msgstr "Mensagem assinada e encriptada"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 msgid "Signed message"
 msgstr "Mensagem assinada"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 msgid "Encrypted message"
 msgstr "Mensagem encriptada"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 msgid "Insecure message"
 msgstr "Mensagem insegura"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 "N?o podes ter a certeza de quem enviou, modificou e leu a mensagem em "
 "tr?nsito."
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr "A mensagem foi assinada, mas a verifica??o falhou com:"
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 msgid "The encryption was VS-NfD-compliant."
 msgstr "A encripta??o est? em conformidade com VS-NfD."
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "A encripta??o n?o est? em conformidade com VS-NfD."
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 "N?o podes ter a certeza de quem enviou a mensagem, porque n?o est? assinada."
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 msgid "You signed this message."
 msgstr "Assinaste esta mensagem."
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr "A identidade dos remetentes foi certificada por ti pr?prio."
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr "O remetente pode certificar identidades para ti."
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 "A identidade dos remetentes foi certificada por v?rias pessoas confi?veis."
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
@@ -670,15 +676,15 @@ msgstr ""
 "A identidade dos remetentes ? certificada pelo emissor confi?vel:\n"
 "'%s'\n"
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr "O provedor de e-mail do destinat?rio forneceu esta chave."
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr "Algumas pessoas confi?veis certificaram a identidade dos remetentes."
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -689,11 +695,11 @@ msgstr ""
 "comunica??o com este endere?o desde %s.\n"
 "Encriptaste %i e verificaste %i mensagens desde ent?o."
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr "A assinatura dos remetentes foi verificada pela primeira vez."
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
@@ -702,68 +708,68 @@ msgstr ""
 "O endere?o dos remetentes ainda n?o ? confi?vel porque apenas verificaste %i "
 "mensagens e encriptaste %i mensagens a eles desde %s."
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr "Mas o endere?o do remetente n?o ? confi?vel porque:"
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr "O endere?o do remetente n?o ? confi?vel porque:"
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 msgid "The signature is invalid: \n"
 msgstr "A assinatura ? inv?lida: \n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr "Houve um erro ao verificar a assinatura.\n"
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 msgid "The signature is expired.\n"
 msgstr "A assinatura expirou.\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr "A chave usada"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used certificate"
 msgstr "O certificado usado"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 msgid "is not available."
 msgstr "n?o est? dispon?vel."
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr "est? revogado."
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr "expirou."
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr "n?o ? destinado a assinar."
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr "n?o pode ser verificado para revoga??o."
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr "n?o ? o mesmo que a chave usada para este endere?o no passado."
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr "n?o reivindica o endere?o: \"%s\"."
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr "n?o est? certificado por qualquer chave confi?vel."
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
@@ -771,57 +777,57 @@ msgstr ""
 "n?o est? certificado por uma Autoridade de Certifica??o confi?vel ou a "
 "Autoridade de Certifica??o ? desconhecida."
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr "O remetente marcou este endere?o como revogado."
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr "est? marcado como n?o confi?vel."
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 msgid "The signature is VS-NfD-compliant."
 msgstr "A assinatura est? em conformidade com VS-NfD."
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 msgid "The signature is not VS-NfD-compliant."
 msgstr "A assinatura n?o est? em conformidade com VS-NfD."
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 msgid "The encryption is VS-NfD-compliant."
 msgstr "A encripta??o est? em conformidade com VS-NfD."
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "A encripta??o n?o est? em conformidade com VS-NfD."
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr "Clica aqui para alterar a chave usada para este endere?o."
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr "Clica aqui para obter detalhes sobre a chave."
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr "Clica aqui para obter detalhes sobre o certificado."
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr "Clica aqui para localizar a chave no servidor de chaves configurado."
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 "Clica aqui para localizar o certificado no servidor de chaves X509 "
 "configurado."
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 msgid "GpgOL: Encryption not possible!"
 msgstr "GpgOL: Encripta??o n?o ? poss?vel!"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -837,11 +843,11 @@ msgstr ""
 "Se continuar a falhar, considera usar um anexo encriptado ou\n"
 "alternar para PGP/Inline nas op??es do GpgOL."
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr "Desculpa, isso n?o ? poss?vel, ainda"
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -865,15 +871,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -881,11 +887,11 @@ msgid ""
 "This is why we only allow quoting to be done manually."
 msgstr ""
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
@@ -895,7 +901,7 @@ msgstr ""
 "N?o podem ser removidos permanentemente e ser?o mostrados novamente na "
 "pr?xima vez que esta mensagem for aberta."
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[sem assunto]"
 
diff --git a/po/sv.po b/po/sv.po
index 1fa357f..a4332a7 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GPGol\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2006-12-12 23:52+0100\n"
 "Last-Translator: Daniel Nylander <po at danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv at listor.tp-sv.se>\n"
@@ -324,12 +324,12 @@ msgstr ""
 msgid "How to report a problem?"
 msgstr ""
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 #, fuzzy
 msgid "Encrypted Message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr ""
 
@@ -381,7 +381,7 @@ msgstr ""
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -521,122 +521,128 @@ msgstr ""
 msgid "Invalid Key"
 msgstr ""
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr ""
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr ""
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 #, fuzzy
 msgid "Encrypted"
 msgstr "Kryptering"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 #, fuzzy
 msgid "Signed message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 #, fuzzy
 msgid "Encrypted message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 #, fuzzy
 msgid "Insecure message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr ""
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 #, fuzzy
 msgid "The encryption was VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 #, fuzzy
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 #, fuzzy
 msgid "You signed this message."
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr ""
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -644,142 +650,142 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 #, fuzzy
 msgid "The used certificate"
 msgstr "Validering"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 #, fuzzy
 msgid "is not available."
 msgstr "Sp?rrlistan ?r inte tillg?nglig\n"
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
 msgstr ""
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 #, fuzzy
 msgid "The signature is VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 #, fuzzy
 msgid "The signature is not VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 #, fuzzy
 msgid "The encryption is VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 #, fuzzy
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 #, fuzzy
 msgid "GpgOL: Encryption not possible!"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -789,11 +795,11 @@ msgid ""
 "switching to PGP/Inline in GpgOL's options."
 msgstr ""
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -807,15 +813,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -823,18 +829,18 @@ msgid ""
 "This is why we only allow quoting to be done manually."
 msgstr ""
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
 "message is opened."
 msgstr ""
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr ""
 
diff --git a/po/uk.po b/po/uk.po
index 33ed165..b4f8f54 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.0.0\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2018-06-12 19:38+0200\n"
 "Last-Translator: Yuri Chornoivan <yurchor at ukr.net>\n"
 "Language-Team: Ukrainian <kde-i18n-uk at kde.org>\n"
@@ -331,12 +331,12 @@ msgstr ""
 msgid "How to report a problem?"
 msgstr ""
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 #, fuzzy
 msgid "Encrypted Message"
 msgstr "??????????? ????????????"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr ""
 
@@ -387,7 +387,7 @@ msgstr "???????? ????????? ????? ?????????? GpgO
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -549,103 +549,109 @@ msgstr ""
 msgid "Invalid Key"
 msgstr ""
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr ""
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr ""
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr "?????? ??????? 4"
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr "?????? ?????????? 4"
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr "?????? ??????? 3"
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr "?????? ?????????? 3"
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr "?????? ??????? 2"
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr "?????? ?????????? 2"
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 msgid "Encrypted"
 msgstr "???????????"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr "??????????"
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 msgid "Signed and encrypted message"
 msgstr "????????? ? ??????????? ????????????"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 msgid "Signed message"
 msgstr "????????? ????????????"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 msgid "Encrypted message"
 msgstr "??????????? ????????????"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 msgid "Insecure message"
 msgstr "?????????? ????????????"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 "?? ?? ?????? ???? ????? ???? ????, ??? ????????, ?????? ?? ????? "
 "???????????? ??? ??? ???????????."
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr "???????????? ???? ?????????, ??? ???? ?? ??????? ?????????:"
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 msgid "The encryption was VS-NfD-compliant."
 msgstr "?????????? ??????? ?? VS-NfD."
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "?????????? ?? ??????? ?? VS-NfD."
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 "?? ?? ?????? ???? ????? ????, ??? ???????? ?? ????????????, ???????? ???? ?? "
 "?????????."
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 msgid "You signed this message."
 msgstr "?? ????????? ?? ????????????."
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr "??????? ??????????? ????????????? ????."
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr "??????????? ????????? ????????????? ??????? ??? ???."
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr "??????? ??????????? ????????????? ?????????? ?????????? ???????."
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
@@ -654,15 +660,15 @@ msgstr ""
 "??????? ??????????? ????????????? ????????? ???????? ????????????:\n"
 "?%s?\n"
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr ""
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr "??????? ??????????? ????????????? ?????????? ?????????? ???????."
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -673,11 +679,11 @@ msgstr ""
 "??????????? ? ???, ????????? ? %s.\n"
 "? ???? ???? ???? ??????????? %i ? ?????????? %i ???????????."
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr "?????? ??????????? ?????????? ??????."
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
@@ -686,69 +692,69 @@ msgstr ""
 "?????? ??????????? ?? ? ?? ?????? ??????, ???????? ???? ?????????? %i "
 "??????????? ?? ??????????? %i ??????????? ?? ????? ? %s."
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr "??? ?????? ??????????? ?? ? ?????? ??????, ????????:"
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr "?????? ??????????? ?? ? ?????? ??????, ????????:"
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 msgid "The signature is invalid: \n"
 msgstr "?????? ? ???????????: \n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr "??? ??? ?????? ?????????? ?????? ??????? ???????.\n"
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 msgid "The signature is expired.\n"
 msgstr "????? ??? ??????? ?????????.\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr "???????????? ????"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used certificate"
 msgstr "???????????? ??????????"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 msgid "is not available."
 msgstr "? ???????????."
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr "??????????."
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr ", ????? ??? ?????????."
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr "?? ?????????? ??? ????????????."
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr "?? ???? ???? ?????????? ?? ???????????."
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 "?? ? ??? ?????, ?? ? ????, ???? ???????????????? ??? ???? ?????? ? ????????."
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr "?? ?????????? ??????: ?%s?."
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr "?? ? ?????????????? ????-???? ?????? ?????? ??????."
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
@@ -756,56 +762,56 @@ msgstr ""
 "?? ?????????? ?????? ?????? ??????? ???????????? ??? ?????? ???????????? ? "
 "?????????."
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr "???????????? ????????? ?? ?????? ?? ??????????."
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr "????????? ?? ?? ????? ??????."
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 msgid "The signature is VS-NfD-compliant."
 msgstr "?????? ? ???????? ?? VS-NfD."
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 msgid "The signature is not VS-NfD-compliant."
 msgstr "?????? ?? ? ???????? ?? VS-NfD."
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 msgid "The encryption is VS-NfD-compliant."
 msgstr "?????????? ? ???????? ?? VS-NfD."
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "?????????? ?? ??????? ?? VS-NfD."
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr "????????? ???, ??? ??????? ????, ???? ??????????? ??? ???? ??????."
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr "????????? ???, ??? ????????? ?????? ??? ????."
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr "????????? ???, ??? ????????? ?????? ??? ??????????."
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr "????????? ???, ??? ???????? ???? ?? ????????????? ??????? ??????."
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 "????????? ???, ??? ???????? ?????????? ?? ????????????? ??????? ?????? X509."
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 msgid "GpgOL: Encryption not possible!"
 msgstr "GpgOL: ?????????? ?????????!"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -823,11 +829,11 @@ msgstr ""
 "????????????\n"
 "?????????? ????? ??? ???????????? ?? PGP/Inline ? ?????????? GpgOL."
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr "???????, ?? ?? ?????????"
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -850,15 +856,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -866,11 +872,11 @@ msgid ""
 "This is why we only allow quoting to be done manually."
 msgstr ""
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
@@ -880,7 +886,7 @@ msgstr ""
 "?? ?? ????? ????????? ???????? ? ?? ????? ???? ???????? ??? ??? ?????????? "
 "????????? ????????????."
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[??? ????]"
 
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 1cbf943..d3e3a07 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2015-08-15 21:58+0800\n"
 "Last-Translator: Mingye Wang (Arthur2e5) <arthur200126 at hotmail.com>\n"
 "Language-Team: \n"
@@ -324,12 +324,12 @@ msgstr ""
 msgid "How to report a problem?"
 msgstr ""
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 #, fuzzy
 msgid "Encrypted Message"
 msgstr "????"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr ""
 
@@ -381,7 +381,7 @@ msgstr ""
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -521,122 +521,128 @@ msgstr ""
 msgid "Invalid Key"
 msgstr ""
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr ""
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr ""
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 #, fuzzy
 msgid "Encrypted"
 msgstr "??"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "????"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 #, fuzzy
 msgid "Signed message"
 msgstr "????"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 #, fuzzy
 msgid "Encrypted message"
 msgstr "????"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 #, fuzzy
 msgid "Insecure message"
 msgstr "????"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr ""
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 #, fuzzy
 msgid "The encryption was VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 #, fuzzy
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 #, fuzzy
 msgid "You signed this message."
 msgstr "????"
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr ""
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -644,142 +650,142 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "????\n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "????\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 #, fuzzy
 msgid "The used certificate"
 msgstr "????"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 #, fuzzy
 msgid "is not available."
 msgstr "???????CRL????\n"
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
 msgstr ""
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 #, fuzzy
 msgid "The signature is VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 #, fuzzy
 msgid "The signature is not VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 #, fuzzy
 msgid "The encryption is VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 #, fuzzy
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 #, fuzzy
 msgid "GpgOL: Encryption not possible!"
 msgstr "????"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -789,11 +795,11 @@ msgid ""
 "switching to PGP/Inline in GpgOL's options."
 msgstr ""
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -807,15 +813,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -823,18 +829,18 @@ msgid ""
 "This is why we only allow quoting to be done manually."
 msgstr ""
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
 "message is opened."
 msgstr ""
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[???]"
 
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 106352c..0aebf24 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2018-11-12 12:52+0100\n"
+"POT-Creation-Date: 2019-01-07 08:43+0100\n"
 "PO-Revision-Date: 2015-08-15 21:58+0800\n"
 "Last-Translator: Mingye Wang (Arthur2e5) <arthur200126 at hotmail.com>\n"
 "Language-Team: \n"
@@ -324,12 +324,12 @@ msgstr ""
 msgid "How to report a problem?"
 msgstr ""
 
-#: src/categorymanager.cpp:250
+#: src/categorymanager.cpp:253
 #, fuzzy
 msgid "Encrypted Message"
 msgstr "????"
 
-#: src/categorymanager.cpp:263
+#: src/categorymanager.cpp:266
 msgid "Junk Email cannot be processed"
 msgstr ""
 
@@ -381,7 +381,7 @@ msgstr ""
 #: src/gpgoladdin.cpp:918 src/gpgoladdin.cpp:953 src/gpgoladdin.cpp:1041
 #: src/gpgoladdin.cpp:1043 src/gpgoladdin.cpp:1080 src/gpgoladdin.cpp:1111
 #: src/gpgoladdin.cpp:1238 src/mail.cpp:984 src/mail.cpp:1311 src/mail.cpp:1380
-#: src/mailitem-events.cpp:869 src/ribbon-callbacks.cpp:700
+#: src/mailitem-events.cpp:877 src/ribbon-callbacks.cpp:700
 #: src/ribbon-callbacks.cpp:714 src/ribbon-callbacks.cpp:763
 #: src/wks-helper.cpp:453 src/cryptcontroller.cpp:314
 #: src/cryptcontroller.cpp:444
@@ -521,122 +521,128 @@ msgstr ""
 msgid "Invalid Key"
 msgstr ""
 
-#: src/mail.cpp:2363
+#. TRANSLATORS: The first placeholder is for tranlsation of "Level".
+#. The second one is for the level number. The third is for the
+#. translation of "trust in" and the last one is for the mail
+#. address used for verification. The result is used as the
+#. text on the green bar for signed mails. e.g.:
+#. "GpgOL: Level 3 trust in 'john.doe at example.org'"
+#: src/mail.cpp:2370
 msgid "Level"
 msgstr ""
 
-#: src/mail.cpp:2364
+#: src/mail.cpp:2371
 msgid "trust in"
 msgstr ""
 
-#: src/mail.cpp:2592
+#: src/mail.cpp:2599
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:2596
+#: src/mail.cpp:2603
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:2600
+#: src/mail.cpp:2607
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:2604
+#: src/mail.cpp:2611
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:2608
+#: src/mail.cpp:2615
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:2612
+#: src/mail.cpp:2619
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:2616
+#: src/mail.cpp:2623
 #, fuzzy
 msgid "Encrypted"
 msgstr "??"
 
-#: src/mail.cpp:2625 src/mail.cpp:2627 src/ribbon-callbacks.cpp:607
+#: src/mail.cpp:2632 src/mail.cpp:2634 src/ribbon-callbacks.cpp:607
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:2640
+#: src/mail.cpp:2647
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "????"
 
-#: src/mail.cpp:2644
+#: src/mail.cpp:2651
 #, fuzzy
 msgid "Signed message"
 msgstr "????"
 
-#: src/mail.cpp:2648
+#: src/mail.cpp:2655
 #, fuzzy
 msgid "Encrypted message"
 msgstr "????"
 
-#: src/mail.cpp:2651 src/ribbon-callbacks.cpp:631
+#: src/mail.cpp:2658 src/ribbon-callbacks.cpp:631
 #, fuzzy
 msgid "Insecure message"
 msgstr "????"
 
-#: src/mail.cpp:2663 src/mail.cpp:2674
+#: src/mail.cpp:2670 src/mail.cpp:2681
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:2666
+#: src/mail.cpp:2673
 msgid "The message was signed but the verification failed with:"
 msgstr ""
 
-#: src/mail.cpp:2684
+#: src/mail.cpp:2691
 #, fuzzy
 msgid "The encryption was VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2688
+#: src/mail.cpp:2695
 #, fuzzy
 msgid "The encryption was not VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2692
+#: src/mail.cpp:2699
 msgid "You cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:2717
+#: src/mail.cpp:2724
 #, fuzzy
 msgid "You signed this message."
 msgstr "????"
 
-#: src/mail.cpp:2721
+#: src/mail.cpp:2728
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:2725
+#: src/mail.cpp:2732
 msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:2738
+#: src/mail.cpp:2745
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:2743
+#: src/mail.cpp:2750
 #, c-format
 msgid ""
 "The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:2751
+#: src/mail.cpp:2758
 msgid "The mail provider of the recipient served this key."
 msgstr ""
 
-#: src/mail.cpp:2756
+#: src/mail.cpp:2763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:2766
+#: src/mail.cpp:2773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -644,142 +650,142 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:2783
+#: src/mail.cpp:2790
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:2790
+#: src/mail.cpp:2797
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:2805
+#: src/mail.cpp:2812
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2806
+#: src/mail.cpp:2813
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:2814
+#: src/mail.cpp:2821
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "????\n"
 
-#: src/mail.cpp:2819
+#: src/mail.cpp:2826
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:2828
+#: src/mail.cpp:2835
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "????\n"
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:2832
+#: src/mail.cpp:2839
 #, fuzzy
 msgid "The used certificate"
 msgstr "????"
 
-#: src/mail.cpp:2840
+#: src/mail.cpp:2847
 #, fuzzy
 msgid "is not available."
 msgstr "???????CRL????\n"
 
-#: src/mail.cpp:2844
+#: src/mail.cpp:2851
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:2848
+#: src/mail.cpp:2855
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:2852
+#: src/mail.cpp:2859
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:2856 src/mail.cpp:2860
+#: src/mail.cpp:2863 src/mail.cpp:2867
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:2865
+#: src/mail.cpp:2872
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:2871
+#: src/mail.cpp:2878
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:2885
+#: src/mail.cpp:2892
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:2889
+#: src/mail.cpp:2896
 msgid ""
 "is not certified by a trustworthy Certificate Authority or the Certificate "
 "Authority is unknown."
 msgstr ""
 
-#: src/mail.cpp:2894
+#: src/mail.cpp:2901
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:2898
+#: src/mail.cpp:2905
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:2908
+#: src/mail.cpp:2915
 #, fuzzy
 msgid "The signature is VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2912
+#: src/mail.cpp:2919
 #, fuzzy
 msgid "The signature is not VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2920
+#: src/mail.cpp:2927
 #, fuzzy
 msgid "The encryption is VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2924
+#: src/mail.cpp:2931
 #, fuzzy
 msgid "The encryption is not VS-NfD-compliant."
 msgstr "????\n"
 
-#: src/mail.cpp:2935
+#: src/mail.cpp:2942
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:2939
+#: src/mail.cpp:2946
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:2940
+#: src/mail.cpp:2947
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:2944
+#: src/mail.cpp:2951
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:2945
+#: src/mail.cpp:2952
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
-#: src/mail.cpp:3291
+#: src/mail.cpp:3298
 #, fuzzy
 msgid "GpgOL: Encryption not possible!"
 msgstr "????"
 
-#: src/mail.cpp:3293
+#: src/mail.cpp:3300
 msgid ""
 "Outlook returned an error when trying to send the encrypted mail.\n"
 "\n"
@@ -789,11 +795,11 @@ msgid ""
 "switching to PGP/Inline in GpgOL's options."
 msgstr ""
 
-#: src/mailitem-events.cpp:314 src/mailitem-events.cpp:922
+#: src/mailitem-events.cpp:322 src/mailitem-events.cpp:930
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:316
+#: src/mailitem-events.cpp:324
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -807,15 +813,15 @@ msgstr ""
 
 #. TRANSLATORS: Part of a warning dialog that disallows
 #. reply and forward with contents
-#: src/mailitem-events.cpp:853
+#: src/mailitem-events.cpp:861
 msgid "You are replying to an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:855
+#: src/mailitem-events.cpp:863
 msgid "You are forwarding an unsigned S/MIME email."
 msgstr ""
 
-#: src/mailitem-events.cpp:858
+#: src/mailitem-events.cpp:866
 msgid ""
 "In this version of S/MIME an attacker could use the missing signature to "
 "have you decrypt contents from a different, otherwise completely unrelated "
@@ -823,18 +829,18 @@ msgid ""
 "This is why we only allow quoting to be done manually."
 msgstr ""
 
-#: src/mailitem-events.cpp:865
+#: src/mailitem-events.cpp:873
 msgid "Please copy the relevant contents and insert them into the new email."
 msgstr ""
 
-#: src/mailitem-events.cpp:919
+#: src/mailitem-events.cpp:927
 msgid ""
 "Attachments are part of the crypto message.\n"
 "They can't be permanently removed and will be shown again the next time this "
 "message is opened."
 msgstr ""
 
-#: src/mapihelp.cpp:2027 src/mapihelp.cpp:2035 src/mapihelp.cpp:2043
+#: src/mapihelp.cpp:2030 src/mapihelp.cpp:2038 src/mapihelp.cpp:2046
 msgid "[no subject]"
 msgstr "[???]"
 

-----------------------------------------------------------------------

Summary of changes:
 po/de.po    | 146 +++++++++++++++++++++++++++++++-----------------------------
 po/fr.po    | 146 +++++++++++++++++++++++++++++++-----------------------------
 po/nl.po    | 124 +++++++++++++++++++++++++++------------------------
 po/pt.po    | 146 +++++++++++++++++++++++++++++++-----------------------------
 po/sv.po    | 146 +++++++++++++++++++++++++++++++-----------------------------
 po/uk.po    | 146 +++++++++++++++++++++++++++++++-----------------------------
 po/zh_CN.po | 146 +++++++++++++++++++++++++++++++-----------------------------
 po/zh_TW.po | 146 +++++++++++++++++++++++++++++++-----------------------------
 8 files changed, 597 insertions(+), 549 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  7 15:49:25 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 07 Jan 2019 15:49:25 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. bca9c59ab107a577464c09905481f880b1244826
Message-ID: <E1ggWDW-0007Ad-ME@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  bca9c59ab107a577464c09905481f880b1244826 (commit)
      from  1849053f29309d9146e42dced4e5f70475496d7b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit bca9c59ab107a577464c09905481f880b1244826
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Mon Jan 7 15:49:08 2019 +0100

    people: Move me up and update me
    
    --

diff --git a/web/people/index.org b/web/people/index.org
index 612ecdb..fbc9379 100644
--- a/web/people/index.org
+++ b/web/people/index.org
@@ -80,6 +80,34 @@
 
    #+HTML: <p style="clear: both"/>
 
+** Andre Heinecke
+
+   #+HTML: <div class="people">
+   #+HTML: <p><img src="aheinecke.png" title="Andre Heinecke" /></p>
+   #+HTML: </div>
+
+   /Windows and UX/
+
+   Andre is working on GnuPG related projects for
+   [[https://www.g10code.at][g10^code Austria GmbH]] He has been an active KDE Developer since 2009,
+   mostly focused on Windows ports of KDE Software. Since 2013 he took
+   over several Windows and UX specific parts of GnuPG.
+
+   Andre is the current maintainer of Kleopatra the KDE / Gpg4win GUI
+   for GnuPG.  He also maintains GpgOL since 2013 and wrote the
+   support for Outlook 2010 and later versions.  Additonally he is the
+   maintainer of Gpg4win in general and GpgEX as well as the GPGME
+   bindings for C++ and Qt.
+
+   He is a founding member and the current cashier of the [[../verein/index.org][GnuPG e.V.]]
+
+   GPG Key: [[https://k.gnupg.net/94A5C9A03C2FE5CA3B095D8E1FDF723CF462B6B1][94A5 C9A0 3C2F E5CA 3B09]] [[https://sks-keyservers.net/pks/lookup?op=get&search=0x94A5C9A03C2FE5CA3B095D8E1FDF723CF462B6B1][5D8E 1FDF 723C F462 B6B1]]
+
+   #+HTML: <p style="clear: both"/>
+
+
+   #+HTML: <hr/>
+
 ** Ben McGinnes
 
    #+HTML: <div class="people">
@@ -108,33 +136,6 @@
 
    #+HTML: <p style="clear: both"/>
 
-** Andre Heinecke
-
-   #+HTML: <div class="people">
-   #+HTML: <p><img src="aheinecke.png" title="Andre Heinecke" /></p>
-   #+HTML: </div>
-
-   /Windows and UX/
-
-   Andre is working mainly on GnuPG related projects for his employer
-   [[https://www.intevation.org][Intevation GmbH]] He has been an active KDE Developer since 2009,
-   mostly focused on Windows ports of KDE Software. Since 2013 he took
-   over several Windows and UX specific parts of GnuPG.
-
-   Andre is the current maintainer of Kleopatra the KDE / Gpg4win GUI
-   for GnuPG.  He also maintains GpgOL since 2013 and wrote the
-   support for Outlook 2010 and later versions.  Additonally he is the
-   maintainer of Gpg4win in general and GpgEX as well as the GPGME
-   bindings for C++ and Qt.
-
-   He is a founding member and the current cashier of the [[../verein/index.org][GnuPG e.V.]]
-
-   GPG Key: [[https://k.gnupg.net/94A5C9A03C2FE5CA3B095D8E1FDF723CF462B6B1][94A5 C9A0 3C2F E5CA 3B09]] [[https://sks-keyservers.net/pks/lookup?op=get&search=0x94A5C9A03C2FE5CA3B095D8E1FDF723CF462B6B1][5D8E 1FDF 723C F462 B6B1]]
-
-   #+HTML: <p style="clear: both"/>
-
-
-   #+HTML: <hr/>
 * Former developers
 
    The following developers made large contributions to GnuPG in the past

-----------------------------------------------------------------------

Summary of changes:
 web/people/index.org | 55 ++++++++++++++++++++++++++--------------------------
 1 file changed, 28 insertions(+), 27 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  8 02:46:37 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 08 Jan 2019 02:46:37 +0100
Subject: [git] GPG-ERROR - branch, gniibe/disable-new-dtags,
 created. gpgrt-1.33-8-g5f9569e
Message-ID: <E1gggTW-00015O-CG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, gniibe/disable-new-dtags has been created
        at  5f9569ee181f807cdfa74e2b12c8fab9f80784fe (commit)

- Log -----------------------------------------------------------------
commit 5f9569ee181f807cdfa74e2b12c8fab9f80784fe
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 8 10:21:44 2019 +0900

    build: Build with LD_LIBRARY_PATH, use of DT_RPATH (2/2).
    
    * configure.ac (LDADD_TESTS): New for --disable-new-dtags.
    * tests/Makefile.am (LDADD): Use LDADD_TESTS.
    (t_lock_LDADD, t_poll_LDADD): Use LDADD.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 8f1598e..dc9b543 100644
--- a/configure.ac
+++ b/configure.ac
@@ -82,7 +82,7 @@ AC_PROG_AWK
 AC_CHECK_TOOL(AR, ar, :)
 AC_GNU_SOURCE
 
-# Taken from mpfr-4.0.1
+# Taken from mpfr-4.0.1, then modified for LDADD_TESTS
 dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
 dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
 dnl the precedence over the run path, so that if a compatible MPFR library
@@ -101,18 +101,21 @@ case $host in
   *-*-linux*)
     if test -n "$LD_LIBRARY_PATH"; then
       saved_LDFLAGS="$LDFLAGS"
-      LDFLAGS="$LDFLAGS -Wl,--disable-new-dtags"
+      LDADD_TESTS="-Wl,--disable-new-dtags"
+      LDFLAGS="$LDFLAGS $LDADD_TESTS"
       AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
       AC_LINK_IFELSE([AC_LANG_SOURCE([[
 int main (void) { return 0; }
       ]])],
       [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
       [AC_MSG_RESULT(no)
-       LDFLAGS="$saved_LDFLAGS"
+       LDADD_TESTS=""
       ])
+      LDFLAGS="$saved_LDFLAGS"
     fi
     ;;
 esac
+AC_SUBST([LDADD_TESTS])
 
 # Set some variables depending on the platform for later use.
 have_w32_system=no
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 71ca3a4..97f06eb 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -33,10 +33,10 @@ TESTS = t-version t-strerror t-syserror t-lock t-printf t-poll t-b64 \
 AM_CPPFLAGS = -I$(top_builddir)/src $(extra_includes)
 
 AM_LDFLAGS = -no-install
-LDADD = $(gpg_error_lib)
+LDADD = $(gpg_error_lib) @LDADD_TESTS@
 
 noinst_PROGRAMS = $(TESTS)
 noinst_HEADERS = t-common.h
 
-t_lock_LDADD = $(gpg_error_lib) $(LIBMULTITHREAD)
-t_poll_LDADD = $(gpg_error_lib) $(LIBMULTITHREAD)
+t_lock_LDADD = $(LDADD) $(LIBMULTITHREAD)
+t_poll_LDADD = $(LDADD) $(LIBMULTITHREAD)

commit 7933692f2e6060f09dc13e2ce07f677feacd364f
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 8 10:05:25 2019 +0900

    build: Build with LD_LIBRARY_PATH, use of DT_RPATH (1/2).
    
    * configure.ac: Check against --disable-new-dtags.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 4a99523..8f1598e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -82,6 +82,38 @@ AC_PROG_AWK
 AC_CHECK_TOOL(AR, ar, :)
 AC_GNU_SOURCE
 
+# Taken from mpfr-4.0.1
+dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
+dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
+dnl the precedence over the run path, so that if a compatible MPFR library
+dnl is installed in some directory from $LD_LIBRARY_PATH, then the tested
+dnl MPFR library will be this library instead of the MPFR library from the
+dnl build tree. Other OS with the same issue might be added later.
+dnl
+dnl References:
+dnl   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859732
+dnl   http://lists.gnu.org/archive/html/libtool/2017-05/msg00000.html
+dnl
+dnl We need to check whether --disable-new-dtags is supported as alternate
+dnl linkers may be used (e.g., with tcc: CC=tcc LD=tcc).
+dnl
+case $host in
+  *-*-linux*)
+    if test -n "$LD_LIBRARY_PATH"; then
+      saved_LDFLAGS="$LDFLAGS"
+      LDFLAGS="$LDFLAGS -Wl,--disable-new-dtags"
+      AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
+      AC_LINK_IFELSE([AC_LANG_SOURCE([[
+int main (void) { return 0; }
+      ]])],
+      [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
+      [AC_MSG_RESULT(no)
+       LDFLAGS="$saved_LDFLAGS"
+      ])
+    fi
+    ;;
+esac
+
 # Set some variables depending on the platform for later use.
 have_w32_system=no
 have_w64_system=no

-----------------------------------------------------------------------


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  8 11:21:39 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 08 Jan 2019 11:21:39 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-316-g6c000d4
Message-ID: <E1ggoVx-00021P-Lx@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6c000d4b78b836686e5a2789cc88a41e465e4400 (commit)
      from  5ab3bc422a5cc1a646c168b547f2b6538b3a4ffa (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6c000d4b78b836686e5a2789cc88a41e465e4400
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 8 11:21:07 2019 +0100

    doc: Mark keyserver-options timeout and http-proxy as obsolete.
    
    --

diff --git a/doc/gpg.texi b/doc/gpg.texi
index a5c172b..6b6c8cc 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1895,32 +1895,12 @@ are available for all keyserver types, some common options are:
   retrieving keys by subkey id.
 
   @item timeout
-  Tell the keyserver helper program how long (in seconds) to try and
-  perform a keyserver action before giving up. Note that performing
-  multiple actions at the same time uses this timeout value per action.
-  For example, when retrieving multiple keys via @option{--receive-keys}, the
-  timeout applies separately to each key retrieval, and not to the
-  @option{--receive-keys} command as a whole. Defaults to 30 seconds.
-
-  @item http-proxy=@var{value}
-  This option is deprecated.
-  Set the proxy to use for HTTP and HKP keyservers.
-  This overrides any proxy defined in @file{dirmngr.conf}.
-
-  @item verbose
-  This option has no more function since GnuPG 2.1.  Use the
-  @code{dirmngr} configuration options instead.
-
-  @item debug
-  This option has no more function since GnuPG 2.1.  Use the
-  @code{dirmngr} configuration options instead.
-
-  @item check-cert
-  This option has no more function since GnuPG 2.1.  Use the
-  @code{dirmngr} configuration options instead.
-
+  @itemx http-proxy=@var{value}
+  @itemx verbose
+  @itemx debug
+  @itemx check-cert
   @item ca-cert-file
-  This option has no more function since GnuPG 2.1.  Use the
+  These options have no more function since GnuPG 2.1.  Use the
   @code{dirmngr} configuration options instead.
 
 @end table

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 30 +++++-------------------------
 1 file changed, 5 insertions(+), 25 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  9 08:26:27 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 09 Jan 2019 08:26:27 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-121-g66376f3
Message-ID: <E1gh8Fw-0006uQ-TJ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  66376f3e206a1aa791d712fb8577bb3490268f60 (commit)
      from  a0dbdfebbb60f0d34dd16894803e95221d8be668 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 66376f3e206a1aa791d712fb8577bb3490268f60
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Wed Jan 9 08:25:21 2019 +0100

    qt: Use tofu conflict test keys without expiry
    
    * lang/qt/tests/t-tofuinfo.cpp: Use new test keys without
    expiry.
    
    --
    The old keys expired on 2019-01-06.
    
    GnuPG-Bug-Id: T3815

diff --git a/lang/qt/tests/t-tofuinfo.cpp b/lang/qt/tests/t-tofuinfo.cpp
index b716102..2d88106 100644
--- a/lang/qt/tests/t-tofuinfo.cpp
+++ b/lang/qt/tests/t-tofuinfo.cpp
@@ -69,46 +69,48 @@ static const char testMsg1[] =
 
 static const char conflictKey1[] = "-----BEGIN PGP PUBLIC KEY BLOCK-----\n"
 "\n"
-"mDMEWG+w/hYJKwYBBAHaRw8BAQdAiq1oStvDYg8ZfFs5DgisYJo8dJxD+C/AA21O\n"
-"K/aif0O0GXRvZnVfY29uZmxpY3RAZXhhbXBsZS5jb22IlgQTFggAPhYhBHoJBLaV\n"
-"DamYAgoa1L5BwMOl/x88BQJYb7D+AhsDBQkDwmcABQsJCAcCBhUICQoLAgQWAgMB\n"
-"Ah4BAheAAAoJEL5BwMOl/x88GvwA/0SxkbLyAcshGm2PRrPsFQsSVAfwaSYFVmS2\n"
-"cMVIw1PfAQDclRH1Z4MpufK07ju4qI33o4s0UFpVRBuSxt7A4P2ZD7g4BFhvsP4S\n"
-"CisGAQQBl1UBBQEBB0AmVrgaDNJ7K2BSalsRo2EkRJjHGqnp5bBB0tapnF81CQMB\n"
-"CAeIeAQYFggAIBYhBHoJBLaVDamYAgoa1L5BwMOl/x88BQJYb7D+AhsMAAoJEL5B\n"
-"wMOl/x88OR0BAMq4/vmJUORRTmzjHcv/DDrQB030DSq666rlckGIKTShAPoDXM9N\n"
-"0gZK+YzvrinSKZXHmn0aSwmC1/hyPybJPEljBw==\n"
-"=p2Oj\n"
+"mDMEXDWgpxYJKwYBBAHaRw8BAQdAguVu4qkx8iw4eU+TQ4vvcKG7IdcZvbMhw3Zc\n"
+"npGf0+u0GXRvZnVfY29uZmxpY3RAZXhhbXBsZS5jb22IkAQTFggAOBYhBO6ovNDG\n"
+"nLzbR1TlMJYJ0fjlWbUrBQJcNaCnAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA\n"
+"AAoJEJYJ0fjlWbUrLaMBALegwkv2+sEcmKZqxt8JscYvFiEuycv2+rKHaZA0eDoN\n"
+"AP97W4XrJb5x49J5jDDdeko8k00uGqiiuAXJo27/i/phA7g4BFw1oKcSCisGAQQB\n"
+"l1UBBQEBB0Crhw24E2lPBhd/y+ZFotQ/2TrYqkUQqGPmff8ofLziNgMBCAeIeAQY\n"
+"FggAIBYhBO6ovNDGnLzbR1TlMJYJ0fjlWbUrBQJcNaCnAhsMAAoJEJYJ0fjlWbUr\n"
+"/K8BAJWsa+tOZsJw7w5fz6O0We6Xx4Rt17jHf563G6wMcz9+AQDRsedJ7w4zYzS9\n"
+"MFiJQ5aN0NDHMRtDFWAgCunVnJ3OBw==\n"
+"=fZa5\n"
 "-----END PGP PUBLIC KEY BLOCK-----\n";
 
 static const char conflictKey2[] = "-----BEGIN PGP PUBLIC KEY BLOCK-----\n"
 "\n"
-"mDMEWG+xShYJKwYBBAHaRw8BAQdA567gPEPJRpqKnZjlFJMRNUqruRviYMyygfF6\n"
-"6Ok+ygu0GXRvZnVfY29uZmxpY3RAZXhhbXBsZS5jb22IlgQTFggAPhYhBJ5kRh7E\n"
-"I98w8kgUcmkAfYFvqqHsBQJYb7FKAhsDBQkDwmcABQsJCAcCBhUICQoLAgQWAgMB\n"
-"Ah4BAheAAAoJEGkAfYFvqqHsYR0BAOz8JjYB4VvGkt6noLS3F5TLfsedGwQkBCw5\n"
-"znw/vGZsAQD9DSX+ekwdrN56mNO8ISt5uVS7B1ZQtouNBF+nzcwbDbg4BFhvsUoS\n"
-"CisGAQQBl1UBBQEBB0BFupW8+Xc1ikab8TJqANjQhvFVh6uLsgcK4g9lZgbGXAMB\n"
-"CAeIeAQYFggAIBYhBJ5kRh7EI98w8kgUcmkAfYFvqqHsBQJYb7FKAhsMAAoJEGkA\n"
-"fYFvqqHs15ABALdN3uiV/07cJ3RkNb3WPcijGsto+lECDS11dKEwTMFeAQDx+V36\n"
-"ocbYC/xEuwi3w45oNqGieazzcD/GBbt8OBk3BA==\n"
-"=45IR\n"
+"mDMEXDWgixYJKwYBBAHaRw8BAQdAMWOhumYspcvEOTuesOSN4rvnJVOj/6qOWFTu\n"
+"x+wPRra0GXRvZnVfY29uZmxpY3RAZXhhbXBsZS5jb22IkAQTFggAOBYhBA64G88Q\n"
+"NPXztj8ID/FhC7tiGbeRBQJcNaCLAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA\n"
+"AAoJEPFhC7tiGbeRUt4A/2hf4Zgz+TYyfeH/4/ZtyL1JuZggqR1s5UopEx2Aiw10\n"
+"AP405KiTd31TJQN8Ru+7bskPu0/mzLZMNkRvBNEdc5kbDLg4BFw1oIsSCisGAQQB\n"
+"l1UBBQEBB0B5NtSrx7wDDKgwUe5Rxz0vRkaWLtyE0KbfE77oPy5DGAMBCAeIeAQY\n"
+"FggAIBYhBA64G88QNPXztj8ID/FhC7tiGbeRBQJcNaCLAhsMAAoJEPFhC7tiGbeR\n"
+"km0BAP8TQwraipqb1pJlLsEgDXeM5Jocz4fuePD78BsOBtORAP9gpCyKXdyJYGlA\n"
+"qjmG356yG6pCK9aPckTZ9IViPiHWCw==\n"
+"=tn3Q\n"
 "-----END PGP PUBLIC KEY BLOCK-----\n";
 
 static const char conflictMsg1[] = "-----BEGIN PGP MESSAGE-----\n"
 "\n"
-"owGbwMvMwCG2z/HA4aX/5W0YT3MlMUTkb2xPSizi6ihlYRDjYJAVU2Sp4mTZNpV3\n"
-"5QwmLqkrMLWsTCCFDFycAjCR1vcMf4U0Qrs6qzqfHJ9puGOFduLN2nVmhsumxjBE\n"
-"mdw4lr1ehIWR4QdLuNBpe86PGx1PtNXfVAzm/hu+vfjCp5BVNjPTM9L0eAA=\n"
-"=MfBD\n"
+"owGbwMvMwCE2jfPij6eRW7UZTwsnMcSYLnT0Ki0uUXD3C1XILFHk6ihlYRDjYJAV\n"
+"U2R5t2LPhWNz9tx2D3lqANPEygTSwcDFKQAT+RjG8M9of873hQrMpinBVwKYv+rq\n"
+"XGmYW+ZcZJ+133KDq+itzlxGhg3L2X/6Khj+2Hd+He+KnXtunF2wNWxl7849e/Sy\n"
+"v6tc+8MBAA==\n"
+"=fZLe\n"
 "-----END PGP MESSAGE-----\n";
 
 static const char conflictMsg2[] = "-----BEGIN PGP MESSAGE-----\n"
 "\n"
-"owGbwMvMwCGWyVDbmL9q4RvG01xJDBH5GyvS8vO5OkpZGMQ4GGTFFFnmpbjJHVG+\n"
-"b/DJQ6QIppaVCaSQgYtTACaySZHhr/SOPrdFJ89KrcwKY5i1XnflXYf2PK76SafK\n"
-"tkxXuXzvJAvDX4kCybuqFk3HXCexz2+IrnZ+5X5EqOnuo3ens2cte+uzlhMA\n"
-"=BIAi\n"
+"owGbwMvMwCH2MZF7d5Lk9omMp4WTGGJMFwZ4lRaXKLj7hSpklihydZSyMIhxMMiK\n"
+"KbLw7ZA+L2Dy9fM2ew5+mCZWJpAOBi5OAZhIUhIjw7bV+xS+cR0quqhmcY2Dl3WW\n"
+"8Ufr+rRNufOPyIdoO6nEXGH47/B+E1+oxS6e5f5n7MJ3aHBO+s345sipGV/4f665\n"
+"9mmiGjsA\n"
+"=8oJA\n"
 "-----END PGP MESSAGE-----\n";
 
 class TofuInfoTest: public QGpgMETest

-----------------------------------------------------------------------

Summary of changes:
 lang/qt/tests/t-tofuinfo.cpp | 58 +++++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 28 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  9 10:10:07 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 09 Jan 2019 10:10:07 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-2.3.2-11-gdfd9fa3
Message-ID: <E1gh9sH-0006bs-AK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  dfd9fa3c85cd51353314d5da73587ed4fa54b3ab (commit)
      from  085ad582eb944625e2e0f56b2569ef3317cf167c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dfd9fa3c85cd51353314d5da73587ed4fa54b3ab
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Wed Jan 9 10:07:26 2019 +0100

    Fix tooltip for bad signature
    
    * src/mail.cpp (Mail::getCryptoDetails_o): Handle bad signature
    explicitly.
    
    --
    Otherwise the code would run into the key error checks and
    would note wrongls that the UID does not match.
    
    GnuPG-Bug-Id: T4299

diff --git a/src/mail.cpp b/src/mail.cpp
index cb87e81..fe4a106 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -2818,7 +2818,12 @@ Mail::getCryptoDetails_o ()
       /* First the general stuff. */
       if (m_sig.summary() & Signature::Summary::Red)
         {
-          message += _("The signature is invalid: \n");
+            message += _("The signature is invalid: \n");
+            if (m_sig.status().code() == GPG_ERR_BAD_SIGNATURE)
+              {
+                message += std::string("\n") + _("The signature does not match.");
+                return message;
+              }
         }
       else if (m_sig.summary() & Signature::Summary::SysError ||
                m_verify_result.numSignatures() < 1)

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  9 11:42:05 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 09 Jan 2019 11:42:05 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.33-7-g07e8c2e
Message-ID: <E1ghBJG-00049f-RU@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  07e8c2e9ed04bb48fa380d8d23d3a7a7353e5878 (commit)
      from  933bfd7b652a907c0d8dd5337c6b5b9cb82ce7b7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 07e8c2e9ed04bb48fa380d8d23d3a7a7353e5878
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 9 11:41:47 2019 +0100

    doc: Describe some causes for GPG_ERR_NO_NAME.
    
    --

diff --git a/doc/errorref.txt b/doc/errorref.txt
index 284123b..21d79ad 100644
--- a/doc/errorref.txt
+++ b/doc/errorref.txt
@@ -781,15 +781,20 @@ GPG_ERR_SEXP_ODD_HEX_NUMBERS  Odd hexadecimal numbers in S-expression
 
 GPG_ERR_SEXP_BAD_OCT_CHAR     Bad octal character in S-expression
 
-GPG_ERR_SUBKEYS_EXP_REV           All subkeys are expired or revoked
+GPG_ERR_SUBKEYS_EXP_REV       All subkeys are expired or revoked
 
-GPG_ERR_DB_CORRUPTED            Database is corrupted
+GPG_ERR_DB_CORRUPTED          Database is corrupted
 
-GPG_ERR_SERVER_FAILED           Server indicated a failure
+GPG_ERR_SERVER_FAILED         Server indicated a failure
 
-GPG_ERR_NO_NAME                         No name
+GPG_ERR_NO_NAME               No name
 
-    EAI_NONAME may be mapped to this code.
+    GNUPG: - No component given in gpgconf runs.
+           - A field name is missing in an import/export filter.
+           - "Domain not found".
+           - "Host not found".
+           - Host or service name not found (EAI_NONAME).
+           - No or erroneous SRV record.
 
 GPG_ERR_NO_KEY          No key
 

-----------------------------------------------------------------------

Summary of changes:
 doc/errorref.txt | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 10 02:31:39 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 10 Jan 2019 02:31:39 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.33-9-g1fd9972
Message-ID: <E1ghPC8-0007Zk-9k@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  1fd997231b717853822dff9d3e981d95765f323d (commit)
       via  1044ee639dab7260da481250cd2a46a69ab2b5d3 (commit)
      from  07e8c2e9ed04bb48fa380d8d23d3a7a7353e5878 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1fd997231b717853822dff9d3e981d95765f323d
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 8 10:21:44 2019 +0900

    build: Build with LD_LIBRARY_PATH, use of DT_RPATH (2/2).
    
    * configure.ac (LDADD_FOR_TESTS_KLUDGE): New for --disable-new-dtags.
    * tests/Makefile.am (LDADD): Use LDADD_FOR_TESTS_KLUDGE.
    (t_lock_LDADD, t_poll_LDADD): Use LDADD.
    
    --
    
    GnuPG-bug-id: 4298
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 8f1598e..400f99e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -82,7 +82,7 @@ AC_PROG_AWK
 AC_CHECK_TOOL(AR, ar, :)
 AC_GNU_SOURCE
 
-# Taken from mpfr-4.0.1
+# Taken from mpfr-4.0.1, then modified for LDADD_FOR_TESTS_KLUDGE
 dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
 dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
 dnl the precedence over the run path, so that if a compatible MPFR library
@@ -101,18 +101,21 @@ case $host in
   *-*-linux*)
     if test -n "$LD_LIBRARY_PATH"; then
       saved_LDFLAGS="$LDFLAGS"
-      LDFLAGS="$LDFLAGS -Wl,--disable-new-dtags"
+      LDADD_FOR_TESTS_KLUDGE="-Wl,--disable-new-dtags"
+      LDFLAGS="$LDFLAGS $LDADD_FOR_TESTS_KLUDGE"
       AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
       AC_LINK_IFELSE([AC_LANG_SOURCE([[
 int main (void) { return 0; }
       ]])],
       [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
       [AC_MSG_RESULT(no)
-       LDFLAGS="$saved_LDFLAGS"
+       LDADD_FOR_TESTS_KLUDGE=""
       ])
+      LDFLAGS="$saved_LDFLAGS"
     fi
     ;;
 esac
+AC_SUBST([LDADD_FOR_TESTS_KLUDGE])
 
 # Set some variables depending on the platform for later use.
 have_w32_system=no
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 71ca3a4..ea02da1 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -33,10 +33,10 @@ TESTS = t-version t-strerror t-syserror t-lock t-printf t-poll t-b64 \
 AM_CPPFLAGS = -I$(top_builddir)/src $(extra_includes)
 
 AM_LDFLAGS = -no-install
-LDADD = $(gpg_error_lib)
+LDADD = $(gpg_error_lib) @LDADD_FOR_TESTS_KLUDGE@
 
 noinst_PROGRAMS = $(TESTS)
 noinst_HEADERS = t-common.h
 
-t_lock_LDADD = $(gpg_error_lib) $(LIBMULTITHREAD)
-t_poll_LDADD = $(gpg_error_lib) $(LIBMULTITHREAD)
+t_lock_LDADD = $(LDADD) $(LIBMULTITHREAD)
+t_poll_LDADD = $(LDADD) $(LIBMULTITHREAD)

commit 1044ee639dab7260da481250cd2a46a69ab2b5d3
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 8 10:05:25 2019 +0900

    build: Build with LD_LIBRARY_PATH, use of DT_RPATH (1/2).
    
    * configure.ac: Check against --disable-new-dtags.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 4a99523..8f1598e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -82,6 +82,38 @@ AC_PROG_AWK
 AC_CHECK_TOOL(AR, ar, :)
 AC_GNU_SOURCE
 
+# Taken from mpfr-4.0.1
+dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
+dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
+dnl the precedence over the run path, so that if a compatible MPFR library
+dnl is installed in some directory from $LD_LIBRARY_PATH, then the tested
+dnl MPFR library will be this library instead of the MPFR library from the
+dnl build tree. Other OS with the same issue might be added later.
+dnl
+dnl References:
+dnl   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859732
+dnl   http://lists.gnu.org/archive/html/libtool/2017-05/msg00000.html
+dnl
+dnl We need to check whether --disable-new-dtags is supported as alternate
+dnl linkers may be used (e.g., with tcc: CC=tcc LD=tcc).
+dnl
+case $host in
+  *-*-linux*)
+    if test -n "$LD_LIBRARY_PATH"; then
+      saved_LDFLAGS="$LDFLAGS"
+      LDFLAGS="$LDFLAGS -Wl,--disable-new-dtags"
+      AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
+      AC_LINK_IFELSE([AC_LANG_SOURCE([[
+int main (void) { return 0; }
+      ]])],
+      [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
+      [AC_MSG_RESULT(no)
+       LDFLAGS="$saved_LDFLAGS"
+      ])
+    fi
+    ;;
+esac
+
 # Set some variables depending on the platform for later use.
 have_w32_system=no
 have_w64_system=no

-----------------------------------------------------------------------

Summary of changes:
 configure.ac      | 35 +++++++++++++++++++++++++++++++++++
 tests/Makefile.am |  6 +++---
 2 files changed, 38 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 14 10:16:33 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 14 Jan 2019 10:16:33 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-2.3.2-13-gcf221af
Message-ID: <E1giyMF-0007lp-2S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  cf221afd9d59b803338206544927116c6ca01259 (commit)
       via  a31338698ae7002f9e9cbc87a8a8aa3dbd3ae0c7 (commit)
      from  dfd9fa3c85cd51353314d5da73587ed4fa54b3ab (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cf221afd9d59b803338206544927116c6ca01259
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Mon Jan 14 10:15:25 2019 +0100

    Fix forwarding of sent mails
    
    * src/cryptcontroller.cpp (CryptController::update_mail_mapi):
    Remove an existing MOSSTMPL if available.
    
    --
    Without this the MOSSTMPL was kept and we then had two
    or more MOSSTMPLs. This resulted in undefined / buggy
    behavior.
    
    GnuPG-Bug-Id: T4321

diff --git a/src/cryptcontroller.cpp b/src/cryptcontroller.cpp
index 217bc87..2f7bae5 100644
--- a/src/cryptcontroller.cpp
+++ b/src/cryptcontroller.cpp
@@ -1019,6 +1019,25 @@ CryptController::update_mail_mapi ()
 
   mapi_attach_item_t *att_table = mapi_create_attach_table (message, 0);
 
+  /* When we forward e.g. a crypto mail we have sent the message
+     has a MOSSTEMPL. We need to remove that. T4321 */
+  for (ULONG pos=0; !att_table[pos].end_of_table; pos++)
+    {
+      if (att_table[pos].attach_type == ATTACHTYPE_MOSSTEMPL)
+        {
+          log_debug ("%s:%s: Found existing moss attachment at "
+                     "pos %i removing it.", SRCNAME, __func__,
+                     att_table[pos].mapipos);
+          if (message->DeleteAttach (att_table[pos].mapipos, 0,
+                                     nullptr, 0) != S_OK)
+            {
+              log_error ("%s:%s: Failed to remove attachment.",
+                         SRCNAME, __func__);
+            }
+
+        }
+    }
+
   // Set up the sink object for our MSOXSMIME attachment.
   struct sink_s sinkmem;
   sink_t sink = &sinkmem;

commit a31338698ae7002f9e9cbc87a8a8aa3dbd3ae0c7
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Mon Jan 14 10:15:14 2019 +0100

    Fix minor typo
    
    --

diff --git a/src/categorymanager.cpp b/src/categorymanager.cpp
index 21f8daf..d641d77 100644
--- a/src/categorymanager.cpp
+++ b/src/categorymanager.cpp
@@ -225,7 +225,7 @@ CategoryManager::removeCategory (Mail *mail, const std::string &category)
     }
   if (remove_category (mail->item (), category.c_str (), true))
     {
-      log_debug ("%s:%s Failed to remvoe category.",
+      log_debug ("%s:%s Failed to remove category.",
                  SRCNAME, __func__);
     }
   d->unregisterCategory (mail->storeID (), category.c_str ());

-----------------------------------------------------------------------

Summary of changes:
 src/categorymanager.cpp |  2 +-
 src/cryptcontroller.cpp | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 14 10:19:28 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 14 Jan 2019 10:19:28 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.33-10-g51ea153
Message-ID: <E1giyP3-00087X-TI@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  51ea153871b79799f88b85f6b60c2b0a3bbd6a12 (commit)
      from  1fd997231b717853822dff9d3e981d95765f323d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 51ea153871b79799f88b85f6b60c2b0a3bbd6a12
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Mon Jan 14 10:18:24 2019 +0100

    Fix symbol name typo in gpg-error.def.in
    
    * src/gpg-error.def.in (gogrt_abort): Correct to gpgrt_abort.

diff --git a/src/gpg-error.def.in b/src/gpg-error.def.in
index a55b31a..0a584c4 100644
--- a/src/gpg-error.def.in
+++ b/src/gpg-error.def.in
@@ -227,6 +227,6 @@ EXPORTS
  gpgrt_w32_override_locale    @173
 
  gpgrt_add_emergency_cleanup  @174
- gogrt_abort                  @175
+ gpgrt_abort                  @175
 
 ;; end of file with public symbols for Windows.

-----------------------------------------------------------------------

Summary of changes:
 src/gpg-error.def.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 14 16:28:27 2019
From: cvs at cvs.gnupg.org (by Ben McGinnes)
Date: Mon, 14 Jan 2019 16:28:27 +0100
Subject: [git] gnupg-doc - branch, ben/w3c-as2,
 updated. 648558c30e0e6bd0fbb978b99922bccadec01655
Message-ID: <E1gj4A8-0004KZ-Jk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, ben/w3c-as2 has been updated
       via  648558c30e0e6bd0fbb978b99922bccadec01655 (commit)
      from  9f7d8cfbdd2bdac71ad870cd0874994174864cdd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 648558c30e0e6bd0fbb978b99922bccadec01655
Author: Ben McGinnes <ben at adversary.org>
Date:   Mon Jan 14 23:51:05 2019 +1100

    protocol: credit
    
    * Fixed the copyright to make it accurate.
    
    Signed-off-by: Ben McGinnes <ben at adversary.org>

diff --git a/misc/w3c/as2/OpenPGPoverActivityStreams.org b/misc/w3c/as2/OpenPGPoverActivityStreams.org
index a4e65c0..1419945 100644
--- a/misc/w3c/as2/OpenPGPoverActivityStreams.org
+++ b/misc/w3c/as2/OpenPGPoverActivityStreams.org
@@ -1343,9 +1343,7 @@ TBA.
    :CUSTOM_ID: copyright
    :END:
 
-Copyright ? Benjamin D. McGinnes, 2018, 2019.
-
-Copyright ? The GnuPG Hackers, 2018.
+Copyright ? Benjamin D. McGinnes, 2018-2019.
 
 
 ** Licensing

-----------------------------------------------------------------------

Summary of changes:
 misc/w3c/as2/OpenPGPoverActivityStreams.org | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 14 21:21:52 2019
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Mon, 14 Jan 2019 21:21:52 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.1-139-g09c2728
Message-ID: <E1gj8k5-0000E8-JF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  09c27280cc09798d15369b3a143036b7ab5ddd69 (commit)
      from  3ee6588de8311b461ef8707c70ff86d2b252966d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 09c27280cc09798d15369b3a143036b7ab5ddd69
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Mon Jan 14 22:14:24 2019 +0200

    camellia-aarch64: do not export look-up table globally
    
    * cipher/camellia-aarch64.S (_gcry_camellia_arm_tables): Remove
    '.globl' export.
    --
    
    Reported-by: Martin Husemann <martin at NetBSD.org>
    GnuPG-bug-id: 4317
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/camellia-aarch64.S b/cipher/camellia-aarch64.S
index b0e9a03..5c6ab02 100644
--- a/cipher/camellia-aarch64.S
+++ b/cipher/camellia-aarch64.S
@@ -289,7 +289,6 @@ _gcry_camellia_arm_decrypt_block:
 ELF(.size _gcry_camellia_arm_decrypt_block,.-_gcry_camellia_arm_decrypt_block;)
 
 /* Encryption/Decryption tables */
-.globl _gcry_camellia_arm_tables
 ELF(.type  _gcry_camellia_arm_tables, at object;)
 .balign 32
 _gcry_camellia_arm_tables:

-----------------------------------------------------------------------

Summary of changes:
 cipher/camellia-aarch64.S | 1 -
 1 file changed, 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 15 05:58:02 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 15 Jan 2019 05:58:02 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.1-140-g2677d7d
Message-ID: <E1gjGnb-0003yv-AG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  2677d7d482bf2d078c1dce64854747c5b148924b (commit)
      from  09c27280cc09798d15369b3a143036b7ab5ddd69 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2677d7d482bf2d078c1dce64854747c5b148924b
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 15 13:53:45 2019 +0900

    random: Use getentropy when available for not GNU/Linux.
    
    * configure.ac: Detect getentropy.
    * random/rndlinux.c [__linux__] (getentropy): Macro defined.
    [HAVE_GETENTROPY] (_gcry_rndlinux_gather_random): Use getentropy.
    
    --
    
    GnuPG-bug-id: 4288
    Reported-by: David Carlier
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 5843884..67cf1f7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1772,7 +1772,7 @@ AC_CHECK_FUNCS(strtoul memmove stricmp atexit raise)
 AC_CHECK_FUNCS(strerror rand mmap getpagesize sysconf waitpid wait4)
 AC_CHECK_FUNCS(gettimeofday getrusage gethrtime clock_gettime syslog)
 AC_CHECK_FUNCS(syscall fcntl ftruncate flockfile)
-AC_CHECK_FUNCS(explicit_bzero)
+AC_CHECK_FUNCS(explicit_bzero getentropy)
 
 GNUPG_CHECK_MLOCK
 
diff --git a/random/rndlinux.c b/random/rndlinux.c
index 3d41cd3..d71261c 100644
--- a/random/rndlinux.c
+++ b/random/rndlinux.c
@@ -32,8 +32,13 @@
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
-#if defined(__linux__) && defined(HAVE_SYSCALL)
+#if defined(__linux__) || !defined(HAVE_GETENTROPY)
+#ifdef HAVE_SYSCALL
 # include <sys/syscall.h>
+# ifdef __NR_getrandom
+# define getentropy(buf,buflen) syscall (__NR_getrandom, buf, buflen, 0)
+# endif
+#endif
 #endif
 
 #include "types.h"
@@ -247,16 +252,14 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
       struct timeval tv;
       int rc;
 
-      /* If we have a modern Linux kernel, we first try to use the new
-       * getrandom syscall.  That call guarantees that the kernel's
+      /* If we have a modern operating system, we first try to use the new
+       * getentropy function.  That call guarantees that the kernel's
        * RNG has been properly seeded before returning any data.  This
        * is different from /dev/urandom which may, due to its
        * non-blocking semantics, return data even if the kernel has
        * not been properly seeded.  And it differs from /dev/random by never
-       * blocking once the kernel is seeded. Unfortunately we need to use a
-       * syscall and not a new device and thus we are not able to use
-       * select(2) to have a timeout. */
-#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
+       * blocking once the kernel is seeded.  */
+#if defined(HAVE_GETENTROPY) || defined(__NR_getrandom)
         {
           long ret;
           size_t nbytes;
@@ -267,20 +270,19 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
               if (nbytes > 256)
                 nbytes = 256;
               _gcry_pre_syscall ();
-              ret = syscall (__NR_getrandom,
-                             (void*)buffer, (size_t)nbytes, (unsigned int)0);
+              ret = getentropy (buffer, nbytes);
               _gcry_post_syscall ();
             }
           while (ret == -1 && errno == EINTR);
           if (ret == -1 && errno == ENOSYS)
-            ; /* The syscall is not supported - fallback to pulling from fd.  */
+            ; /* getentropy is not supported - fallback to pulling from fd.  */
           else
-            { /* The syscall is supported.  Some sanity checks.  */
+            { /* getentropy is supported.  Some sanity checks.  */
               if (ret == -1)
-                log_fatal ("unexpected error from getrandom: %s\n",
+                log_fatal ("unexpected error from getentropy: %s\n",
                            strerror (errno));
               else if (ret != nbytes)
-                log_fatal ("getrandom returned only"
+                log_fatal ("getentropy returned only"
                            " %ld of %zu requested bytes\n", ret, nbytes);
 
               (*add)(buffer, nbytes, origin);

-----------------------------------------------------------------------

Summary of changes:
 configure.ac      |  2 +-
 random/rndlinux.c | 28 +++++++++++++++-------------
 2 files changed, 16 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 15 07:31:15 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 15 Jan 2019 07:31:15 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.33-11-gfd6f64f
Message-ID: <E1gjIFo-0000rO-DB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  fd6f64f1897e00b1d9711463ebb6ec7d099e1995 (commit)
      from  51ea153871b79799f88b85f6b60c2b0a3bbd6a12 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fd6f64f1897e00b1d9711463ebb6ec7d099e1995
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 15 15:29:28 2019 +0900

    build: Fix for BSD make.
    
    * doc/Makefile.am (errorref.txt.x): Don't use $<.
    
    --
    
    Variable $< is only valid for suffix rules in BSD make.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 8cfa95e..d7994d6 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -79,7 +79,7 @@ gpgrt.texi : $(gpgrt_TEXINFOS)
 	touch $(srcdir)/gpgrt.texi
 
 errorref.txt.x : errorref.txt
-	sed '/^##/ d' $< >$@
+	sed '/^##/ d' errorref.txt >$@
 	echo "# Installed by $(PACKAGE_NAME) $(PACKAGE_VERSION)" >>$@
 
 install-data-local: errorref.txt.x

-----------------------------------------------------------------------

Summary of changes:
 doc/Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 15 07:50:33 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 15 Jan 2019 07:50:33 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.1-141-g17f246c
Message-ID: <E1gjIYU-0005Bp-Aq@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  17f246c7044ab9ed236f6ec73fc126654257f0f9 (commit)
      from  2677d7d482bf2d078c1dce64854747c5b148924b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 17f246c7044ab9ed236f6ec73fc126654257f0f9
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 15 15:48:25 2019 +0900

    random: Fix previous commit for getentropy function.
    
    * random/rndlinux.c [__NR_getrandom] (_gcry_rndlinux_gather_random):
    Check return value only for use of syscall.
    
    --
    
    The function returns 0 on success.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/random/rndlinux.c b/random/rndlinux.c
index d71261c..04e2a46 100644
--- a/random/rndlinux.c
+++ b/random/rndlinux.c
@@ -281,9 +281,11 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
               if (ret == -1)
                 log_fatal ("unexpected error from getentropy: %s\n",
                            strerror (errno));
+#ifdef __NR_getrandom
               else if (ret != nbytes)
                 log_fatal ("getentropy returned only"
                            " %ld of %zu requested bytes\n", ret, nbytes);
+#endif
 
               (*add)(buffer, nbytes, origin);
               length -= nbytes;

-----------------------------------------------------------------------

Summary of changes:
 random/rndlinux.c | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 15 08:18:18 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 15 Jan 2019 08:18:18 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.1-142-ge5c2f8a
Message-ID: <E1gjIzL-0001a7-Cv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  e5c2f8a2cd2b89d90ea30de2dedb0e92498a5f70 (commit)
      from  17f246c7044ab9ed236f6ec73fc126654257f0f9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e5c2f8a2cd2b89d90ea30de2dedb0e92498a5f70
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 15 16:14:51 2019 +0900

    build: With LD_LIBRARY_PATH defined, use --disable-new-dtags.
    
    * configure.ac (LDADD_FOR_TESTS_KLUDGE): New for --disable-new-dtags.
    * tests/Makefile.am (LDADD, t_lock_LDADD): Use LDADD_FOR_TESTS_KLUDGE.
    
    --
    
    GnuPG-bug-id: 4298
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 67cf1f7..bb3c666 100644
--- a/configure.ac
+++ b/configure.ac
@@ -146,6 +146,41 @@ AC_PROG_AWK
 
 AC_GNU_SOURCE
 
+# Taken from mpfr-4.0.1, then modified for LDADD_FOR_TESTS_KLUDGE
+dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
+dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
+dnl the precedence over the run path, so that if a compatible MPFR library
+dnl is installed in some directory from $LD_LIBRARY_PATH, then the tested
+dnl MPFR library will be this library instead of the MPFR library from the
+dnl build tree. Other OS with the same issue might be added later.
+dnl
+dnl References:
+dnl   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859732
+dnl   http://lists.gnu.org/archive/html/libtool/2017-05/msg00000.html
+dnl
+dnl We need to check whether --disable-new-dtags is supported as alternate
+dnl linkers may be used (e.g., with tcc: CC=tcc LD=tcc).
+dnl
+case $host in
+  *-*-linux*)
+    if test -n "$LD_LIBRARY_PATH"; then
+      saved_LDFLAGS="$LDFLAGS"
+      LDADD_FOR_TESTS_KLUDGE="-Wl,--disable-new-dtags"
+      LDFLAGS="$LDFLAGS $LDADD_FOR_TESTS_KLUDGE"
+      AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
+      AC_LINK_IFELSE([AC_LANG_SOURCE([[
+int main (void) { return 0; }
+      ]])],
+      [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
+      [AC_MSG_RESULT(no)
+       LDADD_FOR_TESTS_KLUDGE=""
+      ])
+      LDFLAGS="$saved_LDFLAGS"
+    fi
+    ;;
+esac
+AC_SUBST([LDADD_FOR_TESTS_KLUDGE])
+
 VERSION_NUMBER=m4_esyscmd(printf "0x%02x%02x%02x" mym4_major \
                           mym4_minor mym4_micro)
 AC_SUBST(VERSION_NUMBER)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index eee24fa..9e11797 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -62,6 +62,6 @@ EXTRA_DIST = README rsa-16k.key cavs_tests.sh cavs_driver.pl \
 	     blake2b.h blake2s.h \
 	     basic-disable-all-hwf.in basic_all_hwfeature_combinations.sh
 
-LDADD = $(standard_ldadd) $(GPG_ERROR_LIBS)
-t_lock_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS)
+LDADD = $(standard_ldadd) $(GPG_ERROR_LIBS) @LDADD_FOR_TESTS_KLUDGE@
+t_lock_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@
 t_lock_CFLAGS = $(GPG_ERROR_MT_CFLAGS)

-----------------------------------------------------------------------

Summary of changes:
 configure.ac      | 35 +++++++++++++++++++++++++++++++++++
 tests/Makefile.am |  4 ++--
 2 files changed, 37 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 15 08:37:04 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Tue, 15 Jan 2019 08:37:04 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-122-gce327f9
Message-ID: <E1gjJHV-0006EB-7l@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ce327f994a2888b807b63cf202ddcecc3fb9c685 (commit)
      from  66376f3e206a1aa791d712fb8577bb3490268f60 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ce327f994a2888b807b63cf202ddcecc3fb9c685
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Tue Jan 15 08:36:26 2019 +0100

    tests: Add diagnostic example to run-import.c
    
    * tests/run-import.c (main): Show diagnostics in verbose mode.

diff --git a/tests/run-import.c b/tests/run-import.c
index a3c52ac..d98871c 100644
--- a/tests/run-import.c
+++ b/tests/run-import.c
@@ -125,6 +125,20 @@ main (int argc, char **argv)
       gpgme_data_release (data);
     }
 
+  if (verbose)
+    {
+      gpgme_data_t log;
+      char *buf;
+      size_t len;
+
+      gpgme_data_new (&log);
+      err = gpgme_op_getauditlog (ctx, log, GPGME_AUDITLOG_DIAG);
+      fail_if_err (err);
+      buf = gpgme_data_release_and_get_mem (log, &len);
+      printf ("\nDiagnostic output:\n%.*s\n", len, buf);
+      free (buf);
+    }
+
   gpgme_release (ctx);
   return 0;
 }

-----------------------------------------------------------------------

Summary of changes:
 tests/run-import.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 16 02:32:20 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 16 Jan 2019 02:32:20 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-317-gdafffa9
Message-ID: <E1gja46-0005tl-9S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  dafffa95b2317bcb80fff1fd6d2bc7b4e6b1e206 (commit)
      from  6c000d4b78b836686e5a2789cc88a41e465e4400 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dafffa95b2317bcb80fff1fd6d2bc7b4e6b1e206
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 16 10:27:21 2019 +0900

    gpg: Report STATUS_NO_SECKEY when it is examined.
    
    * g10/packet.h (struct pubkey_enc_list): Add result.
    * g10/mainproc.c (proc_pubkey_enc): Initialize ->result.
    (proc_encrypted): Report STATUS_NO_SECKEY status.
    * g10/pubkey-enc.c (get_session_key): Set ->result.
    
    --
    
    This change is for GPGME compatibility.  Before this change,
    gpgme/tests/json/t-json failed with t-decrypt-verify.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/g10/mainproc.c b/g10/mainproc.c
index dce3f37..8c41088 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -481,6 +481,7 @@ proc_pubkey_enc (CTX c, PACKET *pkt)
       x->keyid[0] = enc->keyid[0];
       x->keyid[1] = enc->keyid[1];
       x->pubkey_algo = enc->pubkey_algo;
+      x->result = -1;
       x->data[0] = x->data[1] = NULL;
       if (enc->data[0])
         {
@@ -577,22 +578,21 @@ proc_encrypted (CTX c, PACKET *pkt)
     {
       c->dek = xmalloc_secure_clear (sizeof *c->dek);
       result = get_session_key (c->ctrl, c->pkenc_list, c->dek);
-      if (result  == GPG_ERR_NO_SECKEY)
-        {
-          if (is_status_enabled ())
-            {
-              struct pubkey_enc_list *list;
-
-              for (list = c->pkenc_list; list; list = list->next)
-                {
-                  char buf[20];
-                  snprintf (buf, sizeof buf, "%08lX%08lX",
-                            (ulong)list->keyid[0], (ulong)list->keyid[1]);
-                  write_status_text (STATUS_NO_SECKEY, buf);
-                }
-            }
+      if (is_status_enabled ())
+        {
+          struct pubkey_enc_list *list;
+
+          for (list = c->pkenc_list; list; list = list->next)
+            if (list->result == GPG_ERR_NO_SECKEY)
+              {
+                char buf[20];
+                snprintf (buf, sizeof buf, "%08lX%08lX",
+                          (ulong)list->keyid[0], (ulong)list->keyid[1]);
+                write_status_text (STATUS_NO_SECKEY, buf);
+              }
         }
-      else if (result)
+
+      if (result)
         {
           log_info (_("public key decryption failed: %s\n"),
                     gpg_strerror (result));
diff --git a/g10/packet.h b/g10/packet.h
index 1ec12d6..78a57ba 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -137,6 +137,7 @@ struct pubkey_enc_list
   struct pubkey_enc_list *next;
   u32 keyid[2];
   int pubkey_algo;
+  int result;
   gcry_mpi_t data[PUBKEY_MAX_NENC];
 };
 
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
index ad0a77e..e0a6e8a 100644
--- a/g10/pubkey-enc.c
+++ b/g10/pubkey-enc.c
@@ -132,6 +132,8 @@ get_session_key (ctrl_t ctrl, struct pubkey_enc_list *list, DEK *dek)
           if (openpgp_pk_test_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC))
             continue;
 
+          k->result = GPG_ERR_NO_SECKEY;
+
           if (sk->pubkey_algo != k->pubkey_algo)
             continue;
 
@@ -155,6 +157,7 @@ get_session_key (ctrl_t ctrl, struct pubkey_enc_list *list, DEK *dek)
           rc = get_it (ctrl, k, dek, sk, keyid);
           if (!rc)
             {
+              k->result = 0;
               if (!opt.quiet && !k->keyid[0] && !k->keyid[1])
                 log_info (_("okay, we are the anonymous recipient.\n"));
               search_for_secret_keys = 0;

-----------------------------------------------------------------------

Summary of changes:
 g10/mainproc.c   | 30 +++++++++++++++---------------
 g10/packet.h     |  1 +
 g10/pubkey-enc.c |  3 +++
 3 files changed, 19 insertions(+), 15 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 16 03:02:40 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 16 Jan 2019 03:02:40 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-123-g66bcb8a
Message-ID: <E1gjaXR-0003X5-Of@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  66bcb8acb2452cf19318023ed0ff1ea7d7bb8439 (commit)
      from  ce327f994a2888b807b63cf202ddcecc3fb9c685 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 66bcb8acb2452cf19318023ed0ff1ea7d7bb8439
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 16 10:59:25 2019 +0900

    build: With LD_LIBRARY_PATH defined, use --disable-new-dtags.
    
    * configure.ac (LDADD_FOR_TESTS_KLUDGE): New for --disable-new-dtags.
    * tests/Makefile.am (LDADD): Use LDADD_FOR_TESTS_KLUDGE.
    * lang/cpp/tests/Makefile.am, lang/qt/tests/Makefile.am: Likewise.
    * tests/gpg/Makefile.am, tests/gpgsm/Makefile.am: Likewise.
    * tests/json/Makefile.am, tests/opassuan/Makefile.am: Likewise.
    
    --
    
    GnuPG-bug-id: 4298
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index ff37794..e59a2f8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -105,6 +105,41 @@ AC_ARG_VAR(SYSROOT,[locate config scripts also below that directory])
 # Enable GNU extensions on systems that have them.
 AC_GNU_SOURCE
 
+# Taken from mpfr-4.0.1, then modified for LDADD_FOR_TESTS_KLUDGE
+dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
+dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
+dnl the precedence over the run path, so that if a compatible MPFR library
+dnl is installed in some directory from $LD_LIBRARY_PATH, then the tested
+dnl MPFR library will be this library instead of the MPFR library from the
+dnl build tree. Other OS with the same issue might be added later.
+dnl
+dnl References:
+dnl   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859732
+dnl   http://lists.gnu.org/archive/html/libtool/2017-05/msg00000.html
+dnl
+dnl We need to check whether --disable-new-dtags is supported as alternate
+dnl linkers may be used (e.g., with tcc: CC=tcc LD=tcc).
+dnl
+case $host in
+  *-*-linux*)
+    if test -n "$LD_LIBRARY_PATH"; then
+      saved_LDFLAGS="$LDFLAGS"
+      LDADD_FOR_TESTS_KLUDGE="-Wl,--disable-new-dtags"
+      LDFLAGS="$LDFLAGS $LDADD_FOR_TESTS_KLUDGE"
+      AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
+      AC_LINK_IFELSE([AC_LANG_SOURCE([[
+int main (void) { return 0; }
+      ]])],
+      [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
+      [AC_MSG_RESULT(no)
+       LDADD_FOR_TESTS_KLUDGE=""
+      ])
+      LDFLAGS="$saved_LDFLAGS"
+    fi
+    ;;
+esac
+AC_SUBST([LDADD_FOR_TESTS_KLUDGE])
+
 AH_VERBATIM([_REENTRANT],
 [/* To allow the use of GPGME in multithreaded programs we have to use
   special features from the library.
diff --git a/lang/cpp/tests/Makefile.am b/lang/cpp/tests/Makefile.am
index 67dd3d3..0b27595 100644
--- a/lang/cpp/tests/Makefile.am
+++ b/lang/cpp/tests/Makefile.am
@@ -22,7 +22,7 @@ AM_LDFLAGS = -no-install
 
 LDADD = ../../cpp/src/libgpgmepp.la \
         ../../../src/libgpgme.la @GPG_ERROR_LIBS@ \
-        -lstdc++
+        @LDADD_FOR_TESTS_KLUDGE@ -lstdc++
 
 AM_CPPFLAGS = -I$(top_srcdir)/lang/cpp/src -I$(top_builddir)/src \
               @GPG_ERROR_CFLAGS@ @GPG_ERROR_CFLAGS@ \
diff --git a/lang/qt/tests/Makefile.am b/lang/qt/tests/Makefile.am
index 6d54340..f75d64c 100644
--- a/lang/qt/tests/Makefile.am
+++ b/lang/qt/tests/Makefile.am
@@ -37,7 +37,7 @@ AM_LDFLAGS = -no-install
 
 LDADD = ../../cpp/src/libgpgmepp.la ../src/libqgpgme.la \
         ../../../src/libgpgme.la @GPGME_QT_LIBS@ @GPG_ERROR_LIBS@ \
-        @GPGME_QTTEST_LIBS@ -lstdc++
+        @GPGME_QTTEST_LIBS@ @LDADD_FOR_TESTS_KLUDGE@ -lstdc++
 
 AM_CPPFLAGS = -I$(top_srcdir)/lang/cpp/src -I$(top_builddir)/src \
               @GPG_ERROR_CFLAGS@ @GPGME_QT_CFLAGS@ @GPG_ERROR_CFLAGS@ \
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 8faa05a..8950e96 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -29,7 +29,7 @@ EXTRA_DIST = start-stop-agent t-data-1.txt t-data-2.txt ChangeLog-2011
 
 AM_CPPFLAGS = -I$(top_builddir)/src @GPG_ERROR_CFLAGS@
 AM_LDFLAGS = -no-install
-LDADD = ../src/libgpgme.la @GPG_ERROR_LIBS@
+LDADD = ../src/libgpgme.la @GPG_ERROR_LIBS@ @LDADD_FOR_TESTS_KLUDGE@
 
 noinst_HEADERS = run-support.h
 
@@ -37,7 +37,8 @@ noinst_PROGRAMS = $(TESTS) run-keylist run-export run-import run-sign \
 		  run-verify run-encrypt run-identify run-decrypt run-genkey \
 		  run-keysign run-tofu run-swdb run-threaded
 
-run_threaded_LDADD = ../src/libgpgme.la -lpthread @GPG_ERROR_LIBS@
+run_threaded_LDADD = ../src/libgpgme.la -lpthread @GPG_ERROR_LIBS@ \
+		     @LDADD_FOR_TESTS_KLUDGE@
 
 if RUN_GPG_TESTS
 gpgtests = gpg json
diff --git a/tests/gpg/Makefile.am b/tests/gpg/Makefile.am
index b8d1516..be84290 100644
--- a/tests/gpg/Makefile.am
+++ b/tests/gpg/Makefile.am
@@ -65,11 +65,11 @@ BUILT_SOURCES = gpg.conf gpg-agent.conf pubring-stamp \
            gpg-sample.stamp
 AM_CPPFLAGS = -I$(top_builddir)/src @GPG_ERROR_CFLAGS@
 AM_LDFLAGS = -no-install
-LDADD = ../../src/libgpgme.la
-t_thread1_LDADD = ../../src/libgpgme.la -lpthread
-t_thread_keylist_LDADD = ../../src/libgpgme.la -lpthread
-t_thread_keylist_verify_LDADD = ../../src/libgpgme.la -lpthread
-t_cancel_LDADD = ../../src/libgpgme.la -lpthread
+LDADD = ../../src/libgpgme.la @LDADD_FOR_TESTS_KLUDGE@
+t_thread1_LDADD = ../../src/libgpgme.la -lpthread @LDADD_FOR_TESTS_KLUDGE@
+t_thread_keylist_LDADD = ../../src/libgpgme.la -lpthread @LDADD_FOR_TESTS_KLUDGE@
+t_thread_keylist_verify_LDADD = ../../src/libgpgme.la -lpthread @LDADD_FOR_TESTS_KLUDGE@
+t_cancel_LDADD = ../../src/libgpgme.la -lpthread @LDADD_FOR_TESTS_KLUDGE@
 
 # We don't run t-genkey and t-cancel in the test suite, because it
 # takes too long
diff --git a/tests/gpgsm/Makefile.am b/tests/gpgsm/Makefile.am
index 3706840..63de747 100644
--- a/tests/gpgsm/Makefile.am
+++ b/tests/gpgsm/Makefile.am
@@ -38,7 +38,7 @@ EXTRA_DIST = cert_dfn_pca01.der cert_dfn_pca15.der cert_g10code_test1.der \
 
 AM_CPPFLAGS = -I$(top_builddir)/src @GPG_ERROR_CFLAGS@
 AM_LDFLAGS = -no-install
-LDADD = ../../src/libgpgme.la
+LDADD = ../../src/libgpgme.la @LDADD_FOR_TESTS_KLUDGE@
 
 # We don't run t-genkey in the test suite, because it takes too long
 # and needs a working pinentry.
diff --git a/tests/json/Makefile.am b/tests/json/Makefile.am
index f4db840..9b2cf71 100644
--- a/tests/json/Makefile.am
+++ b/tests/json/Makefile.am
@@ -67,8 +67,9 @@ BUILT_SOURCES = gpg.conf gpg-agent.conf pubring-stamp \
            gpg-sample.stamp
 t_json_SOURCES = t-json.c
 AM_LDFLAGS = -no-install
-LDADD = ../../src/libgpgme.la
-t_json_LDADD = ../../src/cJSON.o -lm ../../src/libgpgme.la @GPG_ERROR_LIBS@
+LDADD = ../../src/libgpgme.la @LDADD_FOR_TESTS_KLUDGE@
+t_json_LDADD = ../../src/cJSON.o -lm ../../src/libgpgme.la @GPG_ERROR_LIBS@ \
+	       @LDADD_FOR_TESTS_KLUDGE@
 
 AM_CPPFLAGS = -I$(top_builddir)/src @GPG_ERROR_CFLAGS@
 
diff --git a/tests/opassuan/Makefile.am b/tests/opassuan/Makefile.am
index 47686eb..b62751d 100644
--- a/tests/opassuan/Makefile.am
+++ b/tests/opassuan/Makefile.am
@@ -27,7 +27,7 @@ TESTS =
 EXTRA_DIST =
 
 AM_CPPFLAGS = -I$(top_builddir)/src @GPG_ERROR_CFLAGS@
-LDADD = ../../src/libgpgme.la
+LDADD = ../../src/libgpgme.la @LDADD_FOR_TESTS_KLUDGE@
 
 noinst_PROGRAMS = $(TESTS) t-command
 

-----------------------------------------------------------------------

Summary of changes:
 configure.ac               | 35 +++++++++++++++++++++++++++++++++++
 lang/cpp/tests/Makefile.am |  2 +-
 lang/qt/tests/Makefile.am  |  2 +-
 tests/Makefile.am          |  5 +++--
 tests/gpg/Makefile.am      | 10 +++++-----
 tests/gpgsm/Makefile.am    |  2 +-
 tests/json/Makefile.am     |  5 +++--
 tests/opassuan/Makefile.am |  2 +-
 8 files changed, 50 insertions(+), 13 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 16 03:10:49 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 16 Jan 2019 03:10:49 +0100
Subject: [git] Assuan - branch, master, updated. libassuan-2.5.2-2-g23bf875
Message-ID: <E1gjafK-0006e1-8n@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPC library used by GnuPG".

The branch, master has been updated
       via  23bf875954329458c0ac6c31e253cba44db8a648 (commit)
      from  1f038e94e19d2bf165f32eb226416377f96c1ebf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 23bf875954329458c0ac6c31e253cba44db8a648
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 16 11:09:33 2019 +0900

    build: With LD_LIBRARY_PATH defined, use --disable-new-dtags.
    
    * configure.ac (LDADD_FOR_TESTS_KLUDGE): New for --disable-new-dtags.
    * tests/Makefile.am (LDADD): Use LDADD_FOR_TESTS_KLUDGE.
    
    --
    
    GnuPG-bug-id: 4298
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 1298eb1..53a4ac6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -85,6 +85,41 @@ AB_INIT
 
 AC_GNU_SOURCE
 
+# Taken from mpfr-4.0.1, then modified for LDADD_FOR_TESTS_KLUDGE
+dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
+dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
+dnl the precedence over the run path, so that if a compatible MPFR library
+dnl is installed in some directory from $LD_LIBRARY_PATH, then the tested
+dnl MPFR library will be this library instead of the MPFR library from the
+dnl build tree. Other OS with the same issue might be added later.
+dnl
+dnl References:
+dnl   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859732
+dnl   http://lists.gnu.org/archive/html/libtool/2017-05/msg00000.html
+dnl
+dnl We need to check whether --disable-new-dtags is supported as alternate
+dnl linkers may be used (e.g., with tcc: CC=tcc LD=tcc).
+dnl
+case $host in
+  *-*-linux*)
+    if test -n "$LD_LIBRARY_PATH"; then
+      saved_LDFLAGS="$LDFLAGS"
+      LDADD_FOR_TESTS_KLUDGE="-Wl,--disable-new-dtags"
+      LDFLAGS="$LDFLAGS $LDADD_FOR_TESTS_KLUDGE"
+      AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
+      AC_LINK_IFELSE([AC_LANG_SOURCE([[
+int main (void) { return 0; }
+      ]])],
+      [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
+      [AC_MSG_RESULT(no)
+       LDADD_FOR_TESTS_KLUDGE=""
+      ])
+      LDFLAGS="$saved_LDFLAGS"
+    fi
+    ;;
+esac
+AC_SUBST([LDADD_FOR_TESTS_KLUDGE])
+
 VERSION_NUMBER=m4_esyscmd(printf "0x%02x%02x%02x" mym4_major \
                           mym4_minor mym4_micro)
 AC_SUBST(VERSION_NUMBER)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 7712a89..85c2d82 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -47,5 +47,6 @@ AM_LDFLAGS = -no-install
 
 noinst_HEADERS = common.h
 noinst_PROGRAMS = $(TESTS) $(w32cetools) $(testtools)
-LDADD = ../src/libassuan.la  $(NETLIBS) $(GPG_ERROR_LIBS)
+LDADD = ../src/libassuan.la  $(NETLIBS) $(GPG_ERROR_LIBS) \
+	@LDADD_FOR_TESTS_KLUDGE@
 

-----------------------------------------------------------------------

Summary of changes:
 configure.ac      | 35 +++++++++++++++++++++++++++++++++++
 tests/Makefile.am |  3 ++-
 2 files changed, 37 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
IPC library used by GnuPG
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 16 03:20:57 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 16 Jan 2019 03:20:57 +0100
Subject: [git] KSBA - branch, master, updated. libksba-1.3.5-34-g3f99f33
Message-ID: <E1gjap8-0008PZ-5g@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "KSBA is a library to access X.509 certificates and CMS data.".

The branch, master has been updated
       via  3f99f332ada603468eb30d77649c4fdf84b383e6 (commit)
      from  c37cdbd0f1b4a682799e0661178e392227cca938 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3f99f332ada603468eb30d77649c4fdf84b383e6
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 16 11:19:54 2019 +0900

    build: With LD_LIBRARY_PATH defined, use --disable-new-dtags.
    
    * configure.ac (LDADD_FOR_TESTS_KLUDGE): New for --disable-new-dtags.
    * tests/Makefile.am (LDADD): Use LDADD_FOR_TESTS_KLUDGE.
    
    --
    
    GnuPG-bug-id: 4298
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index e21f7d0..5ace23b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -71,6 +71,41 @@ AB_INIT
 
 AC_GNU_SOURCE
 
+# Taken from mpfr-4.0.1, then modified for LDADD_FOR_TESTS_KLUDGE
+dnl Under Linux, make sure that the old dtags are used if LD_LIBRARY_PATH
+dnl is defined. The issue is that with the new dtags, LD_LIBRARY_PATH has
+dnl the precedence over the run path, so that if a compatible MPFR library
+dnl is installed in some directory from $LD_LIBRARY_PATH, then the tested
+dnl MPFR library will be this library instead of the MPFR library from the
+dnl build tree. Other OS with the same issue might be added later.
+dnl
+dnl References:
+dnl   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859732
+dnl   http://lists.gnu.org/archive/html/libtool/2017-05/msg00000.html
+dnl
+dnl We need to check whether --disable-new-dtags is supported as alternate
+dnl linkers may be used (e.g., with tcc: CC=tcc LD=tcc).
+dnl
+case $host in
+  *-*-linux*)
+    if test -n "$LD_LIBRARY_PATH"; then
+      saved_LDFLAGS="$LDFLAGS"
+      LDADD_FOR_TESTS_KLUDGE="-Wl,--disable-new-dtags"
+      LDFLAGS="$LDFLAGS $LDADD_FOR_TESTS_KLUDGE"
+      AC_MSG_CHECKING(whether --disable-new-dtags is supported by the linker)
+      AC_LINK_IFELSE([AC_LANG_SOURCE([[
+int main (void) { return 0; }
+      ]])],
+      [AC_MSG_RESULT(yes (use it since LD_LIBRARY_PATH is set))],
+      [AC_MSG_RESULT(no)
+       LDADD_FOR_TESTS_KLUDGE=""
+      ])
+      LDFLAGS="$saved_LDFLAGS"
+    fi
+    ;;
+esac
+AC_SUBST([LDADD_FOR_TESTS_KLUDGE])
+
 LT_PREREQ([2.2.6])
 LT_INIT([win32-dll disable-static])
 LT_LANG([Windows Resource])
diff --git a/tests/Makefile.am b/tests/Makefile.am
index fd590ba..13aea47 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -46,7 +46,7 @@ AM_LDFLAGS = -no-install $(COVERAGE_LDFLAGS)
 
 noinst_HEADERS = t-common.h
 noinst_PROGRAMS = $(TESTS) t-ocsp
-LDADD = ../src/libksba.la $(GPG_ERROR_LIBS)
+LDADD = ../src/libksba.la $(GPG_ERROR_LIBS) @LDADD_FOR_TESTS_KLUDGE@
 
 t_ocsp_SOURCES = t-ocsp.c sha1.c
 

-----------------------------------------------------------------------

Summary of changes:
 configure.ac      | 35 +++++++++++++++++++++++++++++++++++
 tests/Makefile.am |  2 +-
 2 files changed, 36 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
KSBA is a library to access X.509 certificates and CMS data.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 16 08:53:36 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 16 Jan 2019 08:53:36 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.33-14-g2a8978d
Message-ID: <E1gjg13-0004Nt-CM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  2a8978d3504efba4068eb1723498b71286e04de2 (commit)
       via  8bc75741cadf95e2fac64891cf402cde891afe64 (commit)
       via  5d2b20a04b526d090a2328bd79bc3a76ced327dc (commit)
      from  fd6f64f1897e00b1d9711463ebb6ec7d099e1995 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2a8978d3504efba4068eb1723498b71286e04de2
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 16 08:51:44 2019 +0100

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index 22418d2..ce0ee77 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.35 (unreleased) [C26/A26/R_]
+-----------------------------------------------
+
+
 Noteworthy changes in version 1.34 (2019-01-16) [C26/A26/R0]
 -----------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index 4d9dd4a..a7ffb5d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -29,7 +29,7 @@ min_automake_version="1.14"
 # See below for the LT versions.
 m4_define([mym4_package],[libgpg-error])
 m4_define([mym4_major], [1])
-m4_define([mym4_minor], [34])
+m4_define([mym4_minor], [35])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit 8bc75741cadf95e2fac64891cf402cde891afe64
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 16 08:28:22 2019 +0100

    Release 1.34
    
    * configure.ac: Bump LT version to C26/A26/R0.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/AUTHORS b/AUTHORS
index 5d323eb..6c73617 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -16,7 +16,7 @@ listed individually.
 List of Copyright holders
 =========================
 
-  Copyright (C) 2001-2018 g10 Code GmbH
+  Copyright (C) 2001-2019 g10 Code GmbH
   Copyright (C) 1995-2017 Free Software Foundation, Inc.
   Copyright (C) 1998-2006, 2008-2017  Werner Koch
   Copyright (C) 2014 Jedi Lin
diff --git a/NEWS b/NEWS
index 4779bc0..22418d2 100644
--- a/NEWS
+++ b/NEWS
@@ -1,11 +1,19 @@
-Noteworthy changes in version 1.34 (unreleased) [C25/A25/R_]
+Noteworthy changes in version 1.34 (2019-01-16) [C26/A26/R0]
 -----------------------------------------------
 
+ * Support for riscv32.
+
+ * New API to allow emergency cleanup after internal fatal errors.
+
+ * Minor bug and portability fixes. [#4286,#4298
+
  * Interface changes relative to the 1.33 release:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  gpgrt_abort                     NEW.
  gpgrt_add_emergency_cleanup     NEW.
 
+ Release-info: https://dev.gnupg.org/T4296
+
 
 Noteworthy changes in version 1.33 (2018-12-07) [C25/A25/R0]
 -----------------------------------------------
diff --git a/configure.ac b/configure.ac
index 400f99e..4d9dd4a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -49,8 +49,8 @@ AC_INIT([mym4_package],[mym4_version], [https://bugs.gnupg.org])
 #   (Interfaces added:			AGE++)
 #   (Interfaces removed:		AGE=0)
 # Note that added error codes don't constitute an interface change.
-LIBGPG_ERROR_LT_CURRENT=25
-LIBGPG_ERROR_LT_AGE=25
+LIBGPG_ERROR_LT_CURRENT=26
+LIBGPG_ERROR_LT_AGE=26
 LIBGPG_ERROR_LT_REVISION=0
 ################################################
 
diff --git a/src/gpg-error.c b/src/gpg-error.c
index 13703ef..2eb5e7b 100644
--- a/src/gpg-error.c
+++ b/src/gpg-error.c
@@ -454,7 +454,7 @@ my_strusage (int level)
     case 11: p = "gpg-error"; break;
     case 12: p = PACKAGE_NAME; break;
     case 13: p = PACKAGE_VERSION; break;
-    case 14: p = "Copyright (C) 2018 g10 Code GmbH"; break;
+    case 14: p = "Copyright (C) 2019 g10 Code GmbH"; break;
     case 19: p = _("Please report bugs to <https://bugs.gnupg.org>.\n"); break;
 
     case 1:
diff --git a/src/gpg-error.h.in b/src/gpg-error.h.in
index a31fb84..1b9be09 100644
--- a/src/gpg-error.h.in
+++ b/src/gpg-error.h.in
@@ -1,5 +1,5 @@
 /* gpg-error.h or gpgrt.h - Common code for GnuPG and others.    -*- c -*-
- * Copyright (C) 2001-2018 g10 Code GmbH
+ * Copyright (C) 2001-2019 g10 Code GmbH
  *
  * This file is part of libgpg-error (aka libgpgrt).
  *
diff --git a/src/version.c b/src/version.c
index ac2f057..c65f5e9 100644
--- a/src/version.c
+++ b/src/version.c
@@ -39,7 +39,7 @@ cright_blurb (void)
   static const char blurb[] =
     "\n\n"
     "This is Libgpg-error " PACKAGE_VERSION " - A runtime library\n"
-    "Copyright 2001-2018 g10 Code GmbH\n"
+    "Copyright 2001-2019 g10 Code GmbH\n"
     "\n"
     "(" BUILD_REVISION " " BUILD_TIMESTAMP ")\n"
     "\n\n";
diff --git a/src/versioninfo.rc.in b/src/versioninfo.rc.in
index 51575b3..30aab66 100644
--- a/src/versioninfo.rc.in
+++ b/src/versioninfo.rc.in
@@ -40,7 +40,7 @@ BEGIN
             VALUE "FileDescription", "libgpg-error - Common error codes\0"
             VALUE "FileVersion", "@LIBGPG_ERROR_LT_CURRENT at .@LIBGPG_ERROR_LT_AGE at .@LIBGPG_ERROR_LT_REVISION at .@BUILD_REVISION@\0"
             VALUE "InternalName", "libgpg-error\0"
-            VALUE "LegalCopyright", "Copyright ? 2017 g10 Code GmbH\0"
+            VALUE "LegalCopyright", "Copyright ? 2019 g10 Code GmbH\0"
             VALUE "LegalTrademarks", "\0"
             VALUE "OriginalFilename", "libgpg-error.dll\0"
             VALUE "PrivateBuild", "\0"

commit 5d2b20a04b526d090a2328bd79bc3a76ced327dc
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 16 08:43:01 2019 +0100

    build: Fix regression in make distcheck
    
    * doc/Makefile.am (errorref.txt.x):
    --
    
    Fixes-commit: fd6f64f1897e00b1d9711463ebb6ec7d099e1995
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index d7994d6..5d6f201 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -79,7 +79,7 @@ gpgrt.texi : $(gpgrt_TEXINFOS)
 	touch $(srcdir)/gpgrt.texi
 
 errorref.txt.x : errorref.txt
-	sed '/^##/ d' errorref.txt >$@
+	sed '/^##/ d' $(srcdir)/errorref.txt >$@
 	echo "# Installed by $(PACKAGE_NAME) $(PACKAGE_VERSION)" >>$@
 
 install-data-local: errorref.txt.x

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS               |  2 +-
 NEWS                  | 14 +++++++++++++-
 configure.ac          |  6 +++---
 doc/Makefile.am       |  2 +-
 src/gpg-error.c       |  2 +-
 src/gpg-error.h.in    |  2 +-
 src/version.c         |  2 +-
 src/versioninfo.rc.in |  2 +-
 8 files changed, 22 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 16 08:59:57 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 16 Jan 2019 08:59:57 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 5d18bec60b6efff4d3b2f2e234170e80ce7bcc0a
Message-ID: <E1gjg7C-0004nJ-2S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  5d18bec60b6efff4d3b2f2e234170e80ce7bcc0a (commit)
      from  bca9c59ab107a577464c09905481f880b1244826 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5d18bec60b6efff4d3b2f2e234170e80ce7bcc0a
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 16 08:58:29 2019 +0100

    swdb: Release gpgrt 1.34

diff --git a/web/swdb.mac b/web/swdb.mac
index da9c82c..134172e 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -126,16 +126,16 @@
 #
 # LIBGPG-ERROR (aka GPGRT)
 #
-#+macro: libgpg_error_ver  1.33
-#+macro: libgpg_error_date 2018-12-07
-#+macro: libgpg_error_size 896k
-#+macro: libgpg_error_sha1 bd40bf4cb6a0b725f5ea91b68d6ae5aeb387a750
-#+macro: libgpg_error_sha2 5d38826656e746c936e7742d9cde072b50baa3c4c49daa168a56813612bf03ff
-#+macro: gpgrt_ver  1.33
-#+macro: gpgrt_date 2018-12-07
-#+macro: gpgrt_size 896k
-#+macro: gpgrt_sha1 bd40bf4cb6a0b725f5ea91b68d6ae5aeb387a750
-#+macro: gpgrt_sha2 5d38826656e746c936e7742d9cde072b50baa3c4c49daa168a56813612bf03ff
+#+macro: libgpg_error_ver  1.34
+#+macro: libgpg_error_date 2019-01-16
+#+macro: libgpg_error_size 897k
+#+macro: libgpg_error_sha1 0a3e67e428a2e051a94cabd9fb140bf49fdc13d0
+#+macro: libgpg_error_sha2 0680799dee71b86b2f435efb825391eb040ce2704b057f6bd3dcc47fbc398c81
+#+macro: gpgrt_ver  1.34
+#+macro: gpgrt_date 2019-01-16
+#+macro: gpgrt_size 897k
+#+macro: gpgrt_sha1 0a3e67e428a2e051a94cabd9fb140bf49fdc13d0
+#+macro: gpgrt_sha2 0680799dee71b86b2f435efb825391eb040ce2704b057f6bd3dcc47fbc398c81
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/swdb.mac | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 17 00:14:05 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 17 Jan 2019 00:14:05 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.2.12-8-g9dc76d5
Message-ID: <E1gjuNq-0002zD-Fg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  9dc76d599cd4c86d3c187d078daad1144a92564c (commit)
      from  80a08b655f8f5e7a7d78b766f1770fd474081a48 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9dc76d599cd4c86d3c187d078daad1144a92564c
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 7 14:08:51 2019 +0900

    scd: Fix for USB INTERRUPT transfer.
    
    * scd/ccid-driver.c (intr_cb): When LIBUSB_TRANSFER_NO_DEVICE,
    just handle this event as failure.
    
    --
    
    Cherry-picked from master commit:
    
    	5ab3bc422a5cc1a646c168b547f2b6538b3a4ffa
    
    It used to try another interrupt transfer request to make sure
    if it fails again.
    
    GnuPG-bug-id: 4308
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 6b0833b..5bab0b1 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -1470,8 +1470,7 @@ intr_cb (struct libusb_transfer *transfer)
 
   DEBUGOUT_1 ("CCID: interrupt callback %d\n", transfer->status);
 
-  if (transfer->status == LIBUSB_TRANSFER_TIMED_OUT
-      || transfer->status == LIBUSB_TRANSFER_NO_DEVICE)
+  if (transfer->status == LIBUSB_TRANSFER_TIMED_OUT)
     {
       int err;
 

-----------------------------------------------------------------------

Summary of changes:
 scd/ccid-driver.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 17 03:39:09 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 17 Jan 2019 03:39:09 +0100
Subject: [git] NTBTLS - branch, master, updated. ntbtls-0.1.2-21-gf27c173
Message-ID: <E1gjxaI-0000eB-WD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Not Too Bad TLS".

The branch, master has been updated
       via  f27c17396c9e2f3c1581c5d9c80ac257f173cdf6 (commit)
      from  838f83398d728031ea9cab1e7fed5950f4faefa5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f27c17396c9e2f3c1581c5d9c80ac257f173cdf6
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jan 17 11:36:53 2019 +0900

    Remove duplicated typedefs.
    
    * src/ciphersuites.h (ciphersuite_t): Remove.
    * src/context.h (x509_cert_t): Remove.
    
    --
    
    GnuPG-bug-id: 4305
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/src/ciphersuites.h b/src/ciphersuites.h
index 8adae48..e675377 100644
--- a/src/ciphersuites.h
+++ b/src/ciphersuites.h
@@ -192,9 +192,6 @@
 #define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8      0xC0AE  /**< TLS 1.2 */
 #define TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8      0xC0AF  /**< TLS 1.2 */
 
-struct _ntbtls_ciphersuite_s;
-typedef const struct _ntbtls_ciphersuite_s *ciphersuite_t;
-
 #define CIPHERSUITE_FLAG_SHORT_TAG  0x01   /* Short authentication tag.  */
 
 const int *_ntbtls_ciphersuite_list (void);
diff --git a/src/context.h b/src/context.h
index 93652b6..66f7356 100644
--- a/src/context.h
+++ b/src/context.h
@@ -94,13 +94,6 @@ typedef enum
 
 
 /*
- * Object to hold X.509 certificates.
- */
-struct x509_cert_s;
-typedef struct x509_cert_s *x509_cert_t;
-
-
-/*
  * Object to hold an X.509 CRL.
  */
 struct x509_crl_s;
diff --git a/src/util.h b/src/util.h
index d9a0ebe..945bb01 100644
--- a/src/util.h
+++ b/src/util.h
@@ -58,6 +58,9 @@
 #define OID_SIZE(x) (sizeof(x) - 1)
 
 
+/*
+ * Object to hold X.509 certificates.
+ */
 struct x509_cert_s;
 typedef struct x509_cert_s *x509_cert_t;
 

-----------------------------------------------------------------------

Summary of changes:
 src/ciphersuites.h | 3 ---
 src/context.h      | 7 -------
 src/util.h         | 3 +++
 3 files changed, 3 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
Not Too Bad TLS
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 17 15:59:30 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 17 Jan 2019 15:59:30 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-318-gd93797c
Message-ID: <E1gk98m-0002cx-Fn@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d93797c8a7892fe26672c551017468e9f8099ef6 (commit)
      from  dafffa95b2317bcb80fff1fd6d2bc7b4e6b1e206 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d93797c8a7892fe26672c551017468e9f8099ef6
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 17 15:42:33 2019 +0100

    ssh: Simplify the curve name lookup.
    
    * agent/command-ssh.c (struct ssh_key_type_spec): Add field
    alt_curve_name.
    (ssh_key_types): Add some alternate curve names.
    (ssh_identifier_from_curve_name): Lookup also bey alternative names
    and return the canonical name.
    (ssh_key_to_blob): Simplify the ECDSA case by using gcry_pk_get_curve
    instead of the explicit mapping.
    (ssh_receive_key): Likewise.  Use ssh_identifier_from_curve_name to
    validate the curve name.  Remove the reverse mapping because since
    GnuPG-2.2 Libgcrypt 1.7 is required.
    (ssh_handler_request_identities): Log an error message.
    --
    
    This change will make it easier to support other curves, in particular
    those from tokens.  Libgcrypt has a large list of alias names which we
    now use to to make the mapping more flexible.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/command-ssh.c b/agent/command-ssh.c
index 8a41505..ebd28ab 100644
--- a/agent/command-ssh.c
+++ b/agent/command-ssh.c
@@ -195,9 +195,14 @@ struct ssh_key_type_spec
      algorithm.  */
   ssh_signature_encoder_t signature_encoder;
 
-  /* The name of the ECC curve or NULL.  */
+  /* The name of the ECC curve or NULL for non-ECC algos.  This is the
+   * canonical name for the curve as specified by RFC-5656.  */
   const char *curve_name;
 
+  /* An alias for curve_name or NULL.  Actually this is Libcgrypt's
+   * primary name of the curve.  */
+  const char *alt_curve_name;
+
   /* The hash algorithm to be used with this key.  0 for using the
      default.  */
   int hash_algo;
@@ -297,68 +302,71 @@ static const ssh_key_type_spec_t ssh_key_types[] =
     {
       "ssh-ed25519", "Ed25519", GCRY_PK_EDDSA, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_eddsa,
-      "Ed25519", 0,               SPEC_FLAG_IS_EdDSA
+      "Ed25519", NULL, 0,   SPEC_FLAG_IS_EdDSA
     },
     {
       "ssh-rsa", "RSA", GCRY_PK_RSA, "nedupq", "en",   "s",  "nedpqu",
       ssh_key_modifier_rsa, ssh_signature_encoder_rsa,
-      NULL, 0,                    SPEC_FLAG_USE_PKCS1V2
+      NULL, NULL, 0,        SPEC_FLAG_USE_PKCS1V2
     },
     {
       "ssh-dss", "DSA", GCRY_PK_DSA, "pqgyx",  "pqgy", "rs", "pqgyx",
       NULL,                 ssh_signature_encoder_dsa,
-      NULL, 0, 0
+      NULL, NULL, 0, 0
     },
     {
       "ecdsa-sha2-nistp256", "ECDSA", GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA
+      "nistp256", "NIST P-256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA
     },
     {
       "ecdsa-sha2-nistp384", "ECDSA", GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA
+      "nistp384", "NIST P-384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA
     },
     {
       "ecdsa-sha2-nistp521", "ECDSA", GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA
+      "nistp521", "NIST P-521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA
     },
     {
       "ssh-ed25519-cert-v01 at openssh.com", "Ed25519",
       GCRY_PK_EDDSA, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_eddsa,
-      "Ed25519", 0, SPEC_FLAG_IS_EdDSA | SPEC_FLAG_WITH_CERT
+      "Ed25519", NULL, 0,   SPEC_FLAG_IS_EdDSA | SPEC_FLAG_WITH_CERT
     },
     {
       "ssh-rsa-cert-v01 at openssh.com", "RSA",
       GCRY_PK_RSA, "nedupq", "en",   "s",  "nedpqu",
       ssh_key_modifier_rsa, ssh_signature_encoder_rsa,
-      NULL, 0, SPEC_FLAG_USE_PKCS1V2 | SPEC_FLAG_WITH_CERT
+      NULL, NULL, 0, SPEC_FLAG_USE_PKCS1V2 | SPEC_FLAG_WITH_CERT
     },
     {
       "ssh-dss-cert-v01 at openssh.com", "DSA",
       GCRY_PK_DSA, "pqgyx",  "pqgy", "rs", "pqgyx",
       NULL,                 ssh_signature_encoder_dsa,
-      NULL, 0, SPEC_FLAG_WITH_CERT | SPEC_FLAG_WITH_CERT
+      NULL, NULL, 0, SPEC_FLAG_WITH_CERT | SPEC_FLAG_WITH_CERT
     },
     {
       "ecdsa-sha2-nistp256-cert-v01 at openssh.com", "ECDSA",
       GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
+      "nistp256", "NIST P-256", GCRY_MD_SHA256,
+                                SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
     },
     {
       "ecdsa-sha2-nistp384-cert-v01 at openssh.com", "ECDSA",
       GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
+      "nistp384", "NIST P-384", GCRY_MD_SHA384,
+                                SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
     },
     {
       "ecdsa-sha2-nistp521-cert-v01 at openssh.com", "ECDSA",
       GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
+      "nistp521", "NIST P-521", GCRY_MD_SHA512,
+                                SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
     }
   };
 
@@ -389,16 +397,24 @@ realloc_secure (void *a, size_t n)
 
 
 /* Lookup the ssh-identifier for the ECC curve CURVE_NAME.  Returns
-   NULL if not found.  */
+ * NULL if not found.  If found the ssh indetifier is returned and a
+ * pointer to the canonical curve name as specified for ssh is stored
+ * at R_CANON_NAME.  */
 static const char *
-ssh_identifier_from_curve_name (const char *curve_name)
+ssh_identifier_from_curve_name (const char *curve_name,
+                                const char **r_canon_name)
 {
   int i;
 
   for (i = 0; i < DIM (ssh_key_types); i++)
     if (ssh_key_types[i].curve_name
-        && !strcmp (ssh_key_types[i].curve_name, curve_name))
-      return ssh_key_types[i].ssh_identifier;
+        && (!strcmp (ssh_key_types[i].curve_name, curve_name)
+            || (ssh_key_types[i].alt_curve_name
+                && !strcmp (ssh_key_types[i].alt_curve_name, curve_name))))
+      {
+        *r_canon_name = ssh_key_types[i].curve_name;
+        return ssh_key_types[i].ssh_identifier;
+      }
 
   return NULL;
 }
@@ -1849,7 +1865,6 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
   gpg_error_t err = 0;
   gcry_sexp_t value_list = NULL;
   gcry_sexp_t value_pair = NULL;
-  char *curve_name = NULL;
   estream_t stream = NULL;
   void *blob = NULL;
   size_t blob_size;
@@ -1867,7 +1882,7 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
       goto out;
     }
 
-  /* Get the type of the key extpression.  */
+  /* Get the type of the key expression.  */
   data = gcry_sexp_nth_data (sexp, 0, &datalen);
   if (!data)
     {
@@ -1898,49 +1913,17 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
   /* Write the ssh algorithm identifier.  */
   if ((key_spec.flags & SPEC_FLAG_IS_ECDSA))
     {
-      /* Parse the "curve" parameter.  We currently expect the curve
-         name for ECC and not the parameters of the curve.  This can
-         easily be changed but then we need to find the curve name
-         from the parameters using gcry_pk_get_curve.  */
-      const char *mapped;
-      const char *sshname;
-
-      gcry_sexp_release (value_pair);
-      value_pair = gcry_sexp_find_token (value_list, "curve", 5);
-      if (!value_pair)
-	{
-	  err = gpg_error (GPG_ERR_INV_CURVE);
-	  goto out;
-        }
-      curve_name = gcry_sexp_nth_string (value_pair, 1);
-      if (!curve_name)
-	{
-	  err = gpg_error (GPG_ERR_INV_CURVE); /* (Or out of core.)  */
-	  goto out;
-        }
+      /* Map the curve name to the ssh name.  */
+      const char *name, *sshname, *canon_name;
 
-      /* Fixme: The mapping should be done by using gcry_pk_get_curve
-         et al to iterate over all name aliases.  */
-      if (!strcmp (curve_name, "NIST P-256"))
-        mapped = "nistp256";
-      else if (!strcmp (curve_name, "NIST P-384"))
-        mapped = "nistp384";
-      else if (!strcmp (curve_name, "NIST P-521"))
-        mapped = "nistp521";
-      else
-        mapped = NULL;
-      if (mapped)
+      name = gcry_pk_get_curve (sexp, 0, NULL);
+      if (!name)
         {
-          xfree (curve_name);
-          curve_name = xtrystrdup (mapped);
-          if (!curve_name)
-            {
-              err = gpg_error_from_syserror ();
-              goto out;
-            }
+          err = gpg_error (GPG_ERR_INV_CURVE);
+          goto out;
         }
 
-      sshname = ssh_identifier_from_curve_name (curve_name);
+      sshname = ssh_identifier_from_curve_name (name, &canon_name);
       if (!sshname)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
@@ -1949,7 +1932,7 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
       err = stream_write_cstring (stream, sshname);
       if (err)
         goto out;
-      err = stream_write_cstring (stream, curve_name);
+      err = stream_write_cstring (stream, canon_name);
       if (err)
         goto out;
     }
@@ -2022,7 +2005,6 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
  out:
   gcry_sexp_release (value_list);
   gcry_sexp_release (value_pair);
-  xfree (curve_name);
   es_fclose (stream);
   es_free (blob);
 
@@ -2081,7 +2063,7 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
   ssh_key_type_spec_t spec;
   gcry_mpi_t *mpi_list = NULL;
   const char *elems;
-  char *curve_name = NULL;
+  const char *curve_name = NULL;
 
 
   err = stream_read_cstring (stream, &key_type);
@@ -2204,34 +2186,19 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
        * certificate.
        */
       unsigned char *buffer;
-      const char *mapped;
 
       err = stream_read_string (cert? cert : stream, 0, &buffer, NULL);
       if (err)
         goto out;
-      curve_name = buffer;
-      /* Fixme: Check that curve_name matches the keytype.  */
-      /* Because Libgcrypt < 1.6 has no support for the "nistpNNN"
-         curve names, we need to translate them here to Libgcrypt's
-         native names.  */
-      if (!strcmp (curve_name, "nistp256"))
-        mapped = "NIST P-256";
-      else if (!strcmp (curve_name, "nistp384"))
-        mapped = "NIST P-384";
-      else if (!strcmp (curve_name, "nistp521"))
-        mapped = "NIST P-521";
-      else
-        mapped = NULL;
-      if (mapped)
+      /* Get the canonical name.  Should be the same as the read
+       * string but we use this mapping to validate that name.  */
+      if (!ssh_identifier_from_curve_name (buffer, &curve_name))
         {
-          xfree (curve_name);
-          curve_name = xtrystrdup (mapped);
-          if (!curve_name)
-            {
-              err = gpg_error_from_syserror ();
-              goto out;
-            }
+          err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
+          xfree (buffer);
+          goto out;
         }
+      xfree (buffer);
 
       err = ssh_receive_mpint_list (stream, secret, &spec, cert, &mpi_list);
       if (err)
@@ -2299,7 +2266,6 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
  out:
   es_fclose (cert);
   mpint_list_free (mpi_list);
-  xfree (curve_name);
   xfree (key_type);
   xfree (comment);
 
@@ -2647,6 +2613,8 @@ ssh_handler_request_identities (ctrl_t ctrl,
             continue;
 
           err = ssh_send_key_public (key_blobs, key_public, cardsn);
+          if (err && opt.verbose)
+            gcry_log_debugsxp ("pubkey", key_public);
           gcry_sexp_release (key_public);
           key_public = NULL;
           xfree (cardsn);
@@ -2722,6 +2690,8 @@ ssh_handler_request_identities (ctrl_t ctrl,
     }
   else
     {
+      log_error ("ssh request identities failed: %s <%s>\n",
+                 gpg_strerror (err), gpg_strsource (err));
       ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
     }
 

-----------------------------------------------------------------------

Summary of changes:
 agent/command-ssh.c | 138 ++++++++++++++++++++--------------------------------
 1 file changed, 54 insertions(+), 84 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sun Jan 20 11:47:01 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Sun, 20 Jan 2019 11:47:01 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-320-gec56996
Message-ID: <E1glAd5-0003kU-Ov@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ec56996029d95d4bd26e1badfe207232270c6247 (commit)
       via  70bb5c7931598590b1acfae90bf4657f5911d2d3 (commit)
      from  d93797c8a7892fe26672c551017468e9f8099ef6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ec56996029d95d4bd26e1badfe207232270c6247
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 20 11:45:57 2019 +0100

    scd: Add very basic support for PIV cards.
    
    * scd/app-piv.c: New.
    * scd/Makefile.am (card_apps): Add app-piv.c
    * scd/app.c (app_new_register): Try to get a Yubikey serial number.
    Detect the PIV application.
    (get_supported_applications): Add "piv".
    --
    
    Right now this allows the use of the authentication key (9A) for SSH
    authentication.  More support will follow soon.
    
    Tested with Yubikey-5.

diff --git a/scd/Makefile.am b/scd/Makefile.am
index cbd1f9f..0cc50dc 100644
--- a/scd/Makefile.am
+++ b/scd/Makefile.am
@@ -33,7 +33,8 @@ AM_CFLAGS =  $(LIBGCRYPT_CFLAGS) \
 	     $(KSBA_CFLAGS) $(LIBASSUAN_CFLAGS) $(NPTH_CFLAGS)
 
 
-card_apps = app-openpgp.c app-nks.c app-dinsig.c app-p15.c app-geldkarte.c app-sc-hsm.c
+card_apps = app-openpgp.c app-piv.c app-nks.c app-dinsig.c app-p15.c \
+	    app-geldkarte.c app-sc-hsm.c
 
 scdaemon_SOURCES = \
 	scdaemon.c scdaemon.h \
diff --git a/scd/app-common.h b/scd/app-common.h
index 38e6cc6..ff58318 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -206,5 +206,8 @@ gpg_error_t app_select_geldkarte (app_t app);
 /*-- app-sc-hsm.c --*/
 gpg_error_t app_select_sc_hsm (app_t app);
 
+/*-- app-piv.c --*/
+gpg_error_t app_select_piv (app_t app);
+
 
 #endif /*GNUPG_SCD_APP_COMMON_H*/
diff --git a/scd/app-piv.c b/scd/app-piv.c
new file mode 100644
index 0000000..9b40477
--- /dev/null
+++ b/scd/app-piv.c
@@ -0,0 +1,1238 @@
+/* app-piv.c - The OpenPGP card application.
+ * Copyright (C) 2019 g10 Code GmbH
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ */
+
+/* Some notes:
+ * - Specs for PIV are at http://dx.doi.org/10.6028/NIST.SP.800-73-4
+ *
+ */
+
+#include <config.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <time.h>
+
+#include "scdaemon.h"
+
+#include "../common/util.h"
+#include "../common/i18n.h"
+#include "iso7816.h"
+#include "app-common.h"
+#include "../common/tlv.h"
+#include "../common/host2net.h"
+#include "apdu.h" /* We use apdu_send_direct.  */
+
+#define PIV_ALGORITHM_3DES_ECB_0 0x00
+#define PIV_ALGORITHM_2DES_ECB   0x01
+#define PIV_ALGORITHM_2DES_CBC   0x02
+#define PIV_ALGORITHM_3DES_ECB   0x03
+#define PIV_ALGORITHM_3DES_CBC   0x04
+#define PIV_ALGORITHM_RSA        0x07
+#define PIV_ALGORITHM_AES128_ECB 0x08
+#define PIV_ALGORITHM_AES128_CBC 0x09
+#define PIV_ALGORITHM_AES192_ECB 0x0A
+#define PIV_ALGORITHM_AES192_CBC 0x0B
+#define PIV_ALGORITHM_AES256_ECB 0x0C
+#define PIV_ALGORITHM_AES256_CBC 0x0D
+#define PIV_ALGORITHM_ECC_P256   0x11
+#define PIV_ALGORITHM_ECC_P384   0x14
+
+
+
+/* A table describing the DOs of a PIV card.  */
+struct data_object_s
+{
+  unsigned int tag;
+  unsigned int mandatory:1;
+  unsigned int acr_contact:2;     /* 0=always, 1=VCI, 2=PIN, 3=PINorOCC */
+  unsigned int acr_contactless:2; /* 0=always, 1=VCI, 2=VCIandPIN,
+                                                      3=VCIand(PINorOCC) */
+  unsigned int binary:1;          /* Data is not human readable.  */
+  unsigned int dont_cache:1;      /* Data item will not be cached.  */
+  unsigned int flush_on_error:1;  /* Flush cached item on error.  */
+  unsigned int keypair:1;         /* Has a public key for a keypair.  */
+  char keyref[3];                 /* The key reference.  */
+  char *oidsuffix; /* Suffix of the OID, prefix is "2.16.840.1.101.3.7." */
+  char *desc;                     /* Description of the DO.  */
+};
+typedef struct data_object_s *data_object_t;
+static struct data_object_s data_objects[] = {
+  { 0x5FC107, 1, 0,1, 1, 0,0, 0, "",   "1.219.0", "Card Capability Container"},
+  { 0x5FC102, 1, 0,0, 1, 0,0, 0, "",   "2.48.0",  "Cardholder Unique Id" },
+  { 0x5FC105, 1, 0,1, 1, 0,0, 1, "9A", "2.1.1",   "Cert PIV Authentication" },
+  { 0x5FC103, 1, 2,2, 1, 0,0, 0, "",   "2.96.16", "Cardholder Fingerprints" },
+  { 0x5FC106, 1, 0,1, 1, 0,0, 0, "",   "2.144.0", "Security Object" },
+  { 0x5FC108, 1, 2,2, 1, 0,0, 0, "",   "2.96.48", "Cardholder Facial Image" },
+  { 0x5FC101, 1, 0,0, 1, 0,0, 1, "9E", "2.5.0",   "Cert Card Authentication"},
+  { 0x5FC10A, 0, 0,1, 1, 0,0, 1, "9C", "2.1.0",   "Cert Digital Signature" },
+  { 0x5FC10B, 0, 0,1, 1, 0,0, 1, "9D", "2.1.2",   "Cert Key Management" },
+  { 0x5FC109, 0, 3,3, 0, 0,0, 0, "",   "2.48.1",  "Printed Information" },
+  { 0x7E,     0, 0,0, 1, 0,0, 0, "",   "2.96.80", "Discovery Object" },
+  { 0x5FC10C, 0, 0,1, 1, 0,0, 0, "",   "2.96.96", "Key History Object" },
+  { 0x5FC10D, 0, 0,1, 1, 0,0, 0, "82", "2.16.1",  "Retired Cert Key Mgm 1" },
+  { 0x5FC10E, 0, 0,1, 1, 0,0, 0, "83", "2.16.2",  "Retired Cert Key Mgm 2" },
+  { 0x5FC10F, 0, 0,1, 1, 0,0, 0, "84", "2.16.3",  "Retired Cert Key Mgm 3" },
+  { 0x5FC110, 0, 0,1, 1, 0,0, 0, "85", "2.16.4",  "Retired Cert Key Mgm 4" },
+  { 0x5FC111, 0, 0,1, 1, 0,0, 0, "86", "2.16.5",  "Retired Cert Key Mgm 5" },
+  { 0x5FC112, 0, 0,1, 1, 0,0, 0, "87", "2.16.6",  "Retired Cert Key Mgm 6" },
+  { 0x5FC113, 0, 0,1, 1, 0,0, 0, "88", "2.16.7",  "Retired Cert Key Mgm 7" },
+  { 0x5FC114, 0, 0,1, 1, 0,0, 0, "89", "2.16.8",  "Retired Cert Key Mgm 8" },
+  { 0x5FC115, 0, 0,1, 1, 0,0, 0, "8A", "2.16.9",  "Retired Cert Key Mgm 9" },
+  { 0x5FC116, 0, 0,1, 1, 0,0, 0, "8B", "2.16.10", "Retired Cert Key Mgm 10" },
+  { 0x5FC117, 0, 0,1, 1, 0,0, 0, "8C", "2.16.11", "Retired Cert Key Mgm 11" },
+  { 0x5FC118, 0, 0,1, 1, 0,0, 0, "8D", "2.16.12", "Retired Cert Key Mgm 12" },
+  { 0x5FC119, 0, 0,1, 1, 0,0, 0, "8E", "2.16.13", "Retired Cert Key Mgm 13" },
+  { 0x5FC11A, 0, 0,1, 1, 0,0, 0, "8F", "2.16.14", "Retired Cert Key Mgm 14" },
+  { 0x5FC11B, 0, 0,1, 1, 0,0, 0, "90", "2.16.15", "Retired Cert Key Mgm 15" },
+  { 0x5FC11C, 0, 0,1, 1, 0,0, 0, "91", "2.16.16", "Retired Cert Key Mgm 16" },
+  { 0x5FC11D, 0, 0,1, 1, 0,0, 0, "92", "2.16.17", "Retired Cert Key Mgm 17" },
+  { 0x5FC11E, 0, 0,1, 1, 0,0, 0, "93", "2.16.18", "Retired Cert Key Mgm 18" },
+  { 0x5FC11F, 0, 0,1, 1, 0,0, 0, "94", "2.16.19", "Retired Cert Key Mgm 19" },
+  { 0x5FC120, 0, 0,1, 1, 0,0, 0, "95", "2.16.20", "Retired Cert Key Mgm 20" },
+  { 0x5FC121, 0, 2,2, 1, 0,0, 0, "",   "2.16.21", "Cardholder Iris Images" },
+  { 0x7F61,   0, 0,0, 1, 0,0, 0, "",   "2.16.22", "BIT Group Template" },
+  { 0x5FC122, 0, 0,0, 1, 0,0, 0, "",   "2.16.23", "SM Cert Signer" },
+  { 0x5FC123, 0, 3,3, 1, 0,0, 0, "",   "2.16.24", "Pairing Code Ref Data" },
+  { 0 }
+  /* Other key reference values without a tag:
+   * "00" Global PIN (not cleared by application switching)
+   * "04" PIV Secure Messaging Key
+   * "80" PIV Application PIN
+   * "81" PIN Unblocking Key
+   * "96" Primary Finger OCC
+   * "97" Secondary Finger OCC
+   * "98" Pairing Code
+   * "9B" PIV Card Application Administration Key
+   */
+};
+
+
+/* One cache item for DOs.  */
+struct cache_s {
+  struct cache_s *next;
+  int tag;
+  size_t length;
+  unsigned char data[1];
+};
+
+
+/* Object with application specific data.  */
+struct app_local_s {
+  /* A linked list with cached DOs.  */
+  struct cache_s *cache;
+
+  /* Various flags.  */
+  struct
+  {
+    unsigned int dummy:1;
+  } flags;
+
+};
+
+
+/***** Local prototypes  *****/
+static gpg_error_t get_keygrip_by_tag (app_t app, unsigned int tag,
+                                       char **r_keygripstr);
+
+
+
+
+

+/* Deconstructor. */
+static void
+do_deinit (app_t app)
+{
+  if (app && app->app_local)
+    {
+      struct cache_s *c, *c2;
+
+      for (c = app->app_local->cache; c; c = c2)
+        {
+          c2 = c->next;
+          xfree (c);
+        }
+
+      xfree (app->app_local);
+      app->app_local = NULL;
+    }
+}
+
+
+/* Wrapper around iso7816_get_data which first tries to get the data
+ * from the cache.  With GET_IMMEDIATE passed as true, the cache is
+ * bypassed.  The tag-53 container is also removed.  */
+static gpg_error_t
+get_cached_data (app_t app, int tag,
+                 unsigned char **result, size_t *resultlen,
+                 int get_immediate)
+{
+  gpg_error_t err;
+  int i;
+  unsigned char *p;
+  const unsigned char *s;
+  size_t len, n;
+  struct cache_s *c;
+
+  *result = NULL;
+  *resultlen = 0;
+
+  if (!get_immediate)
+    {
+      for (c=app->app_local->cache; c; c = c->next)
+        if (c->tag == tag)
+          {
+            if(c->length)
+              {
+                p = xtrymalloc (c->length);
+                if (!p)
+                  return gpg_error_from_syserror ();
+                memcpy (p, c->data, c->length);
+                *result = p;
+              }
+
+            *resultlen = c->length;
+
+            return 0;
+          }
+    }
+
+  err = iso7816_get_data_odd (app->slot, 0, tag, &p, &len);
+  if (err)
+    return err;
+
+  /* Unless the Discovery Object or the BIT Group Template is
+   * requested, remove the outer container.
+   * (SP800-73.4 Part 2, section 3.1.2)   */
+  if (tag == 0x7E || tag == 0x7F61)
+    ;
+  else if (len && *p == 0x53 && (s = find_tlv (p, len, 0x53, &n)))
+    {
+      memmove (p, s, n);
+      len = n;
+    }
+
+  if (len)
+    *result = p;
+  *resultlen = len;
+
+  /* Check whether we should cache this object. */
+  if (get_immediate)
+    return 0;
+
+  for (i=0; data_objects[i].tag; i++)
+    if (data_objects[i].tag == tag)
+      {
+        if (data_objects[i].dont_cache)
+          return 0;
+        break;
+      }
+
+  /* Okay, cache it. */
+  for (c=app->app_local->cache; c; c = c->next)
+    log_assert (c->tag != tag);
+
+  c = xtrymalloc (sizeof *c + len);
+  if (c)
+    {
+      if (len)
+        memcpy (c->data, p, len);
+      else
+        xfree (p);
+      c->length = len;
+      c->tag = tag;
+      c->next = app->app_local->cache;
+      app->app_local->cache = c;
+    }
+
+  return 0;
+}
+
+
+/* Get the DO identified by TAG from the card in SLOT and return a
+ * buffer with its content in RESULT and NBYTES.  The return value is
+ * NULL if not found or a pointer which must be used to release the
+ * buffer holding value.  */
+static void *
+get_one_do (app_t app, int tag, unsigned char **result, size_t *nbytes,
+            int *r_err)
+{
+  gpg_error_t err;
+  int i;
+  unsigned char *buffer;
+  size_t buflen;
+  unsigned char *value;
+  size_t valuelen;
+  gpg_error_t dummyerr;
+
+  if (!r_err)
+    r_err = &dummyerr;
+
+  *result = NULL;
+  *nbytes = 0;
+  *r_err = 0;
+  for (i=0; data_objects[i].tag && data_objects[i].tag != tag; i++)
+    ;
+
+  value = NULL;
+  err = gpg_error (GPG_ERR_ENOENT);
+
+  if (!value) /* Not in a constructed DO, try simple. */
+    {
+      err = get_cached_data (app, tag, &buffer, &buflen,
+                             data_objects[i].dont_cache);
+      if (!err)
+        {
+          value = buffer;
+          valuelen = buflen;
+        }
+    }
+
+  if (!err)
+    {
+      *nbytes = valuelen;
+      *result = value;
+      return buffer;
+    }
+
+  *r_err = err;
+  return NULL;
+}
+
+
+static void
+dump_all_do (int slot)
+{
+  gpg_error_t err;
+  int i;
+  unsigned char *buffer;
+  size_t buflen;
+
+  for (i=0; data_objects[i].tag; i++)
+    {
+      /* We don't try extended length APDU because such large DO would
+         be pretty useless in a log file.  */
+      err = iso7816_get_data_odd (slot, 0, data_objects[i].tag,
+                                 &buffer, &buflen);
+      if (err)
+        {
+          if (gpg_err_code (err) == GPG_ERR_ENOENT
+              && !data_objects[i].mandatory)
+            ;
+          else
+            log_info ("DO '%s' not available: %s\n",
+                      data_objects[i].desc, gpg_strerror (err));
+        }
+      else
+        {
+          if (data_objects[i].binary)
+            {
+              log_info ("DO '%s': ", data_objects[i].desc);
+              if (buflen > 16 && opt.verbose < 2)
+                {
+                  log_printhex (buffer, 16, NULL);
+                  log_printf ("[...]\n");
+                }
+              else
+                log_printhex (buffer, buflen, "");
+            }
+          else
+            log_info ("DO '%s': '%.*s'\n",
+                      data_objects[i].desc,
+                      (int)buflen, buffer);
+
+        }
+      xfree (buffer); buffer = NULL;
+    }
+}
+
+
+/* Return an allocated string with the serial number in a format to be
+ * show to the user.  With FAILMODE is true return NULL if such an
+ * abbreviated S/N is not available, else return the full serial
+ * number as a hex string.  May return NULL on malloc problem.  */
+static char *
+get_dispserialno (app_t app, int failmode)
+{
+  char *result;
+
+  if (app->serialno && app->serialnolen == 3+1+4
+      && !memcmp (app->serialno, "\xff\x02\x00", 3))
+    {
+      /* This is a 4 byte S/N of a Yubikey which seems to be printed
+       * on the token in decimal.  Maybe they will print larger S/N
+       * also in decimal but we can't be sure, thus do it only for
+       * these 32 bit numbers.  */
+      unsigned long sn;
+      sn  = app->serialno[4] * 16777216;
+      sn += app->serialno[5] * 65536;
+      sn += app->serialno[6] * 256;
+      sn += app->serialno[7];
+      result = xtryasprintf ("yk-%lu", sn);
+    }
+  else if (failmode)
+    result = NULL;  /* No Abbreviated S/N.  */
+  else
+    result = app_get_serialno (app);
+
+  return result;
+}
+
+
+/* Implementation of the GETATTR command.  This is similar to the
+ * LEARN command but returns only one value via status lines.  */
+static gpg_error_t
+do_getattr (app_t app, ctrl_t ctrl, const char *name)
+{
+  static struct {
+    const char *name;
+    int tag;
+    int special;
+  } table[] = {
+    { "SERIALNO",     0x0000, -1 },
+    { "$AUTHKEYID",   0x0000, -2 }, /* Default key for ssh.  */
+    { "$DISPSERIALNO",0x0000, -3 }
+  };
+  gpg_error_t err = 0;
+  int idx;
+  void *relptr;
+  unsigned char *value;
+  size_t valuelen;
+
+  for (idx=0; (idx < DIM (table)
+               && ascii_strcasecmp (table[idx].name, name)); idx++)
+    ;
+  if (!(idx < DIM (table)))
+    err = gpg_error (GPG_ERR_INV_NAME);
+  else if (table[idx].special == -1)
+    {
+      char *serial = app_get_serialno (app);
+
+      if (serial)
+        {
+          send_status_direct (ctrl, "SERIALNO", serial);
+          xfree (serial);
+        }
+    }
+  else if (table[idx].special == -2)
+    {
+      char const tmp[] = "PIV.9A"; /* Cert PIV Authenticate.  */
+      send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
+    }
+  else if (table[idx].special == -3)
+    {
+      char *tmp = get_dispserialno (app, 1);
+
+      if (tmp)
+        {
+          send_status_info (ctrl, table[idx].name,
+                            tmp, strlen (tmp),
+                            NULL, (size_t)0);
+          xfree (tmp);
+        }
+      else
+        err = gpg_error (GPG_ERR_INV_NAME);  /* No Abbreviated S/N.  */
+    }
+  else
+    {
+      relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &err);
+      if (relptr)
+        {
+          send_status_info (ctrl, table[idx].name, value, valuelen, NULL, 0);
+          xfree (relptr);
+        }
+    }
+
+  return err;
+}
+
+
+/* Send the KEYPAIRINFO back.  DOBJ describes the data object carrying
+ * the key.  This is used by the LEARN command. */
+static gpg_error_t
+send_keypair_and_cert_info (app_t app, ctrl_t ctrl, data_object_t dobj,
+                            int only_keypair)
+{
+  gpg_error_t err = 0;
+  char *keygripstr = NULL;
+  char idbuf[50];
+
+  err = get_keygrip_by_tag (app, dobj->tag, &keygripstr);
+  if (err)
+    goto leave;
+
+  snprintf (idbuf, sizeof idbuf, "PIV.%s", dobj->keyref);
+  send_status_info (ctrl, "KEYPAIRINFO",
+                    keygripstr, strlen (keygripstr),
+                    idbuf, strlen (idbuf),
+                    NULL, (size_t)0);
+  if (!only_keypair)
+    {
+      /* All certificates are of type 100 (Regular X.509 Cert).  */
+      send_status_info (ctrl, "CERTINFO",
+                        "100", 3,
+                        idbuf, strlen (idbuf),
+                        NULL, (size_t)0);
+    }
+
+ leave:
+  xfree (keygripstr);
+  return err;
+}
+
+
+/* Handle the LEARN command for OpenPGP.  */
+static gpg_error_t
+do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
+{
+  int i;
+
+  (void)flags;
+
+  for (i=0; data_objects[i].tag; i++)
+    if (data_objects[i].keypair)
+      send_keypair_and_cert_info (app, ctrl, data_objects + i, !!(flags & 1));
+
+  return 0;
+}
+
+
+/* Core of do-readcert which fetches the certificate based on the
+ * given tag and returns it in a freshly allocated buffer stored at
+ * R_CERT and the length of the certificate stored at R_CERTLEN.  */
+static gpg_error_t
+readcert_by_tag (app_t app, unsigned int tag,
+                 unsigned char **r_cert, size_t *r_certlen)
+{
+  gpg_error_t err;
+  unsigned char *buffer;
+  size_t buflen;
+  void *relptr;
+  const unsigned char *s;
+  size_t n;
+
+  *r_cert = NULL;
+  *r_certlen = 0;
+
+  relptr = get_one_do (app, tag, &buffer, &buflen, NULL);
+  if (!relptr || !buflen)
+   {
+      err = gpg_error (GPG_ERR_NOT_FOUND);
+      goto leave;
+    }
+
+  s = find_tlv (buffer, buflen, 0x71, &n);
+  if (!s || n != 1)
+    {
+      log_error ("piv: no or invalid CertInfo in 0x%X\n", tag);
+      err = gpg_error (GPG_ERR_INV_CERT_OBJ);
+      goto leave;
+    }
+  if (*s == 0x01)
+    {
+      log_error ("piv: gzip compression not yet supported (tag 0x%X)\n", tag);
+      err = gpg_error (GPG_ERR_UNSUPPORTED_ENCODING);
+      goto leave;
+    }
+  if (*s)
+    {
+      log_error ("piv: invalid CertInfo 0x%02x in 0x%X\n", *s, tag);
+      err = gpg_error (GPG_ERR_INV_CERT_OBJ);
+      goto leave;
+    }
+
+  /* Note: We don't check that the LRC octet has a length of zero as
+   * required by the specs.  */
+
+  /* Get the cert from the container.  */
+  s = find_tlv (buffer, buflen, 0x70, &n);
+  if (!s || !n)
+    {
+      err = gpg_error (GPG_ERR_NOT_FOUND);
+      goto leave;
+    }
+
+  if (!(*r_cert = xtrymalloc (n)))
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  memcpy (*r_cert, s, n);
+  *r_certlen = n;
+  err = 0;
+
+ leave:
+  xfree (relptr);
+  return err;
+}
+
+
+/* Get the keygrip of a key from the certificate stored at TAG.
+ * Caller must free the string at R_KEYGRIPSTR. */
+static gpg_error_t
+get_keygrip_by_tag (app_t app, unsigned int tag, char **r_keygripstr)
+{
+  gpg_error_t err;
+  unsigned char *certbuf = NULL;
+  size_t certbuflen;
+  ksba_cert_t cert = NULL;
+
+  *r_keygripstr = xtrymalloc (40+1);
+  if (!r_keygripstr)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  /* We need to get the public key from the certificate.  */
+  err = readcert_by_tag (app, tag, &certbuf, &certbuflen);
+  if (err)
+    goto leave;
+
+  /* Compute the keygrip.  */
+  err = ksba_cert_new (&cert);
+  if (err)
+    goto leave;
+  err = ksba_cert_init_from_mem (cert, certbuf, certbuflen);
+  if (err)
+    goto leave;
+  err = app_help_get_keygrip_string (cert, *r_keygripstr);
+
+
+ leave:
+  ksba_cert_release (cert);
+  xfree (certbuf);
+  if (err)
+    {
+      xfree (*r_keygripstr);
+      *r_keygripstr = NULL;
+    }
+  return err;
+}
+
+
+/* Locate the data object from the given KEYREF.  The KEYREF may also
+ * be the corresponding OID of the key object.  Returns the data
+ * object or NULL if not found.  */
+static data_object_t
+find_dobj_by_keyref (app_t app, const char *keyref)
+{
+  int i;
+
+  (void)app;
+
+  if (!ascii_strncasecmp (keyref, "PIV.", 4))
+    {
+      keyref += 4;
+      for (i=0; data_objects[i].tag; i++)
+        if (*data_objects[i].keyref
+            && !ascii_strcasecmp (keyref, data_objects[i].keyref))
+          {
+            return data_objects + i;
+          }
+    }
+  else if (!strncmp (keyref, "2.16.840.1.101.3.7.", 19))
+    {
+      keyref += 19;
+      for (i=0; data_objects[i].tag; i++)
+        if (*data_objects[i].keyref
+            && !strcmp (keyref, data_objects[i].oidsuffix))
+          {
+            return data_objects + i;
+          }
+    }
+
+  return NULL;
+}
+
+
+/* Read a certificate from the card and returned in a freshly
+ * allocated buffer stored at R_CERT and the length of the certificate
+ * stored at R_CERTLEN.  CERTID is either the OID of the cert's
+ * container or of the form "PIV.<two_hexdigit_keyref>"  */
+static gpg_error_t
+do_readcert (app_t app, const char *certid,
+             unsigned char **r_cert, size_t *r_certlen)
+{
+  data_object_t dobj;
+
+  *r_cert = NULL;
+  *r_certlen = 0;
+
+  dobj = find_dobj_by_keyref (app, certid);
+  if (!dobj)
+    return gpg_error (GPG_ERR_INV_ID);
+
+  return readcert_by_tag (app, dobj->tag, r_cert, r_certlen);
+}
+
+
+/* Given a data object DOBJ return the corresponding PIV algorithm and
+ * store it at R_ALGO.  The algorithm is taken from the corresponding
+ * certificate or from a cache.  */
+static gpg_error_t
+get_key_algorithm_by_dobj (app_t app, data_object_t dobj, int *r_algo)
+{
+  gpg_error_t err;
+  unsigned char *certbuf = NULL;
+  size_t certbuflen;
+  ksba_cert_t cert = NULL;
+  ksba_sexp_t k_pkey = NULL;
+  gcry_sexp_t s_pkey = NULL;
+  gcry_sexp_t l1 = NULL;
+  char *algoname = NULL;
+  int algo;
+  size_t n;
+  const char *curve_name;
+
+  *r_algo = 0;
+
+  err = readcert_by_tag (app, dobj->tag, &certbuf, &certbuflen);
+  if (err)
+    goto leave;
+
+  err = ksba_cert_new (&cert);
+  if (err)
+    goto leave;
+
+  err = ksba_cert_init_from_mem (cert, certbuf, certbuflen);
+  if (err)
+    {
+      log_error ("piv: failed to parse the certificate %s: %s\n",
+                 dobj->keyref, gpg_strerror (err));
+      goto leave;
+    }
+  xfree (certbuf);
+  certbuf = NULL;
+
+  k_pkey = ksba_cert_get_public_key (cert);
+  if (!k_pkey)
+    {
+      err = gpg_error (GPG_ERR_NO_PUBKEY);
+      goto leave;
+    }
+  n = gcry_sexp_canon_len (k_pkey, 0, NULL, NULL);
+  err = gcry_sexp_new (&s_pkey, k_pkey, n, 0);
+  if (err)
+    goto leave;
+
+  l1 = gcry_sexp_find_token (s_pkey, "public-key", 0);
+  if (!l1)
+    {
+      err = gpg_error (GPG_ERR_NO_PUBKEY);
+      goto leave;
+    }
+
+  {
+    gcry_sexp_t l_tmp = gcry_sexp_cadr (l1);
+    gcry_sexp_release (l1);
+    l1 = l_tmp;
+  }
+  algoname = gcry_sexp_nth_string (l1, 0);
+  if (!algoname)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  algo = gcry_pk_map_name (algoname);
+  switch (algo)
+    {
+    case GCRY_PK_RSA:
+      algo = PIV_ALGORITHM_RSA;
+      break;
+
+    case GCRY_PK_ECC:
+    case GCRY_PK_ECDSA:
+    case GCRY_PK_ECDH:
+      curve_name = gcry_pk_get_curve (s_pkey, 0, NULL);
+      if (curve_name && !strcmp (curve_name, "NIST P-256"))
+        algo = PIV_ALGORITHM_ECC_P256;
+      else if (curve_name && !strcmp (curve_name, "NIST P-384"))
+        algo = PIV_ALGORITHM_ECC_P384;
+      else
+        {
+          err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
+          log_error ("piv: certificate %s, curve '%s': %s\n",
+                     dobj->keyref, curve_name, gpg_strerror (err));
+          goto leave;
+        }
+      break;
+
+    default:
+      err = gpg_error (GPG_ERR_PUBKEY_ALGO);
+      log_error ("piv: certificate %s, pubkey algo '%s': %s\n",
+                 dobj->keyref, algoname, gpg_strerror (err));
+      goto leave;
+    }
+  *r_algo = algo;
+
+ leave:
+  gcry_free (algoname);
+  gcry_sexp_release (l1);
+  gcry_sexp_release (s_pkey);
+  ksba_free (k_pkey);
+  xfree (certbuf);
+  return err;
+}
+
+
+/* Return an allocated string to be used as prompt.  Returns NULL on
+ * malloc error.  */
+static char *
+make_prompt (app_t app, int remaining, const char *firstline)
+{
+  char *serial, *tmpbuf, *result;
+
+  serial = get_dispserialno (app, 0);
+  if (!serial)
+    return NULL;
+
+  /* TRANSLATORS: Put a \x1f right before a colon.  This can be
+   * used by pinentry to nicely align the names and values.  Keep
+   * the %s at the start and end of the string.  */
+  result = xtryasprintf (_("%s"
+                           "Number\x1f: %s%%0A"
+                           "Holder\x1f: %s"
+                           "%s"),
+                         "\x1e",
+                         serial,
+                         "Unknown", /* Fixme */
+                         "");
+  xfree (serial);
+
+  /* Append a "remaining attempts" info if needed.  */
+  if (remaining != -1 && remaining < 3)
+    {
+      char *rembuf;
+
+      /* TRANSLATORS: This is the number of remaining attempts to
+       * enter a PIN.  Use %%0A (double-percent,0A) for a linefeed. */
+      rembuf = xtryasprintf (_("Remaining attempts: %d"), remaining);
+      if (rembuf)
+        {
+          tmpbuf = strconcat (firstline, "%0A%0A", result,
+                              "%0A%0A", rembuf, NULL);
+          xfree (rembuf);
+        }
+      else
+        tmpbuf = NULL;
+      xfree (result);
+      result = tmpbuf;
+    }
+  else
+    {
+      tmpbuf = strconcat (firstline, "%0A%0A", result, NULL);
+      xfree (result);
+      result = tmpbuf;
+    }
+
+  return result;
+}
+
+
+
+/* Verify the Application PIN for use with data object DOBJ.  */
+static gpg_error_t
+verify_pin (app_t app, data_object_t dobj,
+            gpg_error_t (*pincb)(void*,const char *,char **), void *pincb_arg)
+{
+  gpg_error_t err;
+  unsigned char apdu[4];
+  unsigned int sw;
+  int remaining;
+  char *prompt;
+  char *pinvalue = NULL;
+  unsigned int pinlen;
+  char pinbuffer[8];
+
+  /* First check whether a verify is at all needed.  This is done with
+   * P1 being 0 and no Lc and command data send.  */
+  apdu[0] = 0x00;
+  apdu[1] = ISO7816_VERIFY;
+  apdu[2] = 0x00;
+  apdu[3] = 0x80;
+  if (!iso7816_apdu_direct (app->slot, apdu, 4, 0, &sw, NULL, NULL))
+    {
+      /* No need to verification.  */
+      return 0;  /* All fine.  */
+    }
+  if ((sw & 0xfff0) == 0x63C0)
+    remaining = (sw & 0x000f); /* PIN has REMAINING tries left.  */
+  else
+    remaining = -1;
+
+  if (remaining != -1)
+    log_debug ("piv: PIN for %s has %d attempts left\n",
+               dobj->keyref, remaining);
+
+  /* Ask for the PIN.  */
+  prompt = make_prompt (app, remaining, _("||Please enter your PIV PIN"));
+  err = pincb (pincb_arg, prompt, &pinvalue);
+  xfree (prompt);
+  prompt = NULL;
+  if (err)
+    {
+      log_info (_("PIN callback returned error: %s\n"), gpg_strerror (err));
+      return err;
+    }
+
+  pinlen = pinvalue? strlen (pinvalue) : 0;
+  if (pinlen < 6)
+    {
+      log_error (_("PIN for is too short;"
+                   " minimum length is %d\n"), 6);
+      if (pinvalue)
+        wipememory (pinvalue, pinlen);
+      xfree (pinvalue);
+      return gpg_error (GPG_ERR_BAD_PIN);
+    }
+  if (pinlen > sizeof pinbuffer)
+    {
+      log_error (_("PIN for is too long;"
+                   " maximum length is %d\n"), (int)sizeof pinbuffer);
+      wipememory (pinvalue, pinlen);
+      xfree (pinvalue);
+      return gpg_error (GPG_ERR_BAD_PIN);
+    }
+  if (strspn (pinvalue, "0123456789") != pinlen)
+    {
+      log_error (_("PIN has invalid characters; only digits are allowed\n"));
+      wipememory (pinvalue, pinlen);
+      xfree (pinvalue);
+      return gpg_error (GPG_ERR_BAD_PIN);
+    }
+  memcpy (pinbuffer, pinvalue, pinlen);
+  memset (pinbuffer + pinlen, 0xff, sizeof(pinbuffer) - pinlen);
+  wipememory (pinvalue, pinlen);
+  xfree (pinvalue);
+
+  err = iso7816_verify (app->slot, 0x80,
+                        pinbuffer, sizeof pinbuffer);
+  wipememory (pinbuffer, sizeof pinbuffer);
+  if (err)
+    log_error ("PIN verification failed: %s\n", gpg_strerror (err));
+
+  return err;
+}
+
+
+/* Compute a digital signature using the GENERAL AUTHENTICATE command
+ * on INDATA which is expected to be the raw message digest.  The
+ * KEYIDSTR has the key reference or its OID (e.g. "PIV.9A").  The
+ * result is stored at (R_OUTDATA,R_OUTDATALEN); on error (NULL,0) is
+ * stored there and an error code returned.  For ECDSA the result is
+ * the simple concatenation of R and S without any DER encoding.  R
+ * and S are left extended with zeroes to make sure they have an equal
+ * length.
+ */
+static gpg_error_t
+do_auth (app_t app, const char *keyidstr,
+         gpg_error_t (*pincb)(void*, const char *, char **),
+         void *pincb_arg,
+         const void *indata_arg, size_t indatalen,
+         unsigned char **r_outdata, size_t *r_outdatalen)
+{
+  const unsigned char *indata = indata_arg;
+  gpg_error_t err;
+  data_object_t dobj;
+  unsigned char tmpl[2+2+2+128];
+  size_t tmpllen;
+  unsigned char *outdata = NULL;
+  size_t outdatalen;
+  const unsigned char *s;
+  size_t n;
+  int keyref, algo;
+
+  if (!keyidstr || !*keyidstr)
+    {
+      err = gpg_error (GPG_ERR_INV_VALUE);
+      goto leave;
+    }
+
+  /* Fixme: Shall we support the KEYID/FINGERPRINT syntax?  Does it
+   * make sense for X.509 certs?  */
+
+  dobj = find_dobj_by_keyref (app, keyidstr);
+  if (!dobj)
+    {
+      err = gpg_error (GPG_ERR_INV_ID);
+      goto leave;
+    }
+  keyref = xtoi_2 (dobj->keyref);
+
+  err = get_key_algorithm_by_dobj (app, dobj, &algo);
+  if (err)
+    goto leave;
+
+  /* We need to remove the ASN.1 prefix from INDATA.  We use TEMPL as
+   * a temporary buffer for the OID.  */
+  if (algo == PIV_ALGORITHM_ECC_P256)
+    {
+      tmpllen = sizeof tmpl;
+      err = gcry_md_get_asnoid (GCRY_MD_SHA256, &tmpl, &tmpllen);
+      if (err)
+        {
+          err = gpg_error (GPG_ERR_INTERNAL);
+          log_debug ("piv: no OID for hash algo %d\n", GCRY_MD_SHA256);
+          goto leave;
+        }
+      if (indatalen != tmpllen + 32 || memcmp (indata, tmpl, tmpllen))
+        {
+          err = GPG_ERR_INV_VALUE;
+          log_error ("piv: bad formatted input for ECC-P256 auth\n");
+          goto leave;
+        }
+      indata +=tmpllen;
+      indatalen -= tmpllen;
+    }
+  else if (algo == PIV_ALGORITHM_ECC_P384)
+    {
+      tmpllen = sizeof tmpl;
+      err = gcry_md_get_asnoid (GCRY_MD_SHA384, &tmpl, &tmpllen);
+      if (err)
+        {
+          err = gpg_error (GPG_ERR_INTERNAL);
+          log_debug ("piv: no OID for hash algo %d\n", GCRY_MD_SHA384);
+          goto leave;
+        }
+      if (indatalen != tmpllen + 48 || memcmp (indata, tmpl, tmpllen))
+        {
+          err = GPG_ERR_INV_VALUE;
+          log_error ("piv: bad formatted input for ECC-P384 auth\n");
+          goto leave;
+        }
+      indata += tmpllen;
+      indatalen -= tmpllen;
+    }
+  else if (algo == PIV_ALGORITHM_RSA)
+    {
+      err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+      log_error ("piv: FIXME: implement RSA authentication\n");
+      goto leave;
+    }
+  else
+    {
+      err = gpg_error (GPG_ERR_INTERNAL);
+      log_debug ("piv: unknown PIV  algo %d from helper function\n", algo);
+      goto leave;
+    }
+
+  /* Because we don't have a dynamic template builder we make sure
+   * that we can encode all lengths in one octet.  FIXME: Use add_tls
+   * from app-openpgp as a base for an strconcat like function. */
+  if (indatalen >= 100)
+    {
+      err = gpg_error (GPG_ERR_TOO_LARGE);
+      goto leave;
+    }
+
+  /* Now verify the PIN.  */
+  err = verify_pin (app, dobj, pincb, pincb_arg);
+  if (err)
+    return err;
+
+  /* Build the Dynamic Authentication Template.  */
+  tmpl[0] = 0x7c;
+  tmpl[1] = indatalen + 4;
+  tmpl[2] = 0x82; /* Response. */
+  tmpl[3] = 0;    /* Must be 0 to get the tag in the answer.  */
+  tmpl[4] = 0x81; /* Challenge. */
+  tmpl[5] = indatalen;
+  memcpy (tmpl+6, indata, indatalen);
+  tmpllen = indatalen + 6;
+
+  /* Note: the -1 requests command chaining.  */
+  err = iso7816_general_authenticate (app->slot, -1,
+                                      algo, keyref,
+                                      tmpl, (int)tmpllen, 0,
+                                      &outdata, &outdatalen);
+  if (err)
+    goto leave;
+
+  /* Parse the response.  */
+  if (outdatalen && *outdata == 0x7c
+      && (s = find_tlv (outdata, outdatalen, 0x82, &n)))
+    {
+      const unsigned char *rval, *sval;
+      size_t rlen, rlenx, slen, slenx, resultlen;
+      char *result;
+      /* The result of an ECDSA signature is
+       *   SEQUENCE { r INTEGER, s INTEGER }
+       * We re-pack that by concatenating R and S and making sure that
+       * both have the same length.  We simplify parsing by using
+       * find_tlv and not a proper DER parser.  */
+      s = find_tlv (s, n, 0x30, &n);
+      if (!s)
+        goto bad_der;
+      rval = find_tlv (s, n, 0x02, &rlen);
+      if (!rval)
+        goto bad_der;
+      log_assert (n >= (rval-s)+rlen);
+      sval = find_tlv (rval+rlen, n-((rval-s)+rlen), 0x02, &slen);
+      if (!rval)
+        goto bad_der;
+      rlenx = slenx = 0;
+      if (rlen > slen)
+        slenx = rlen - slen;
+      else if (slen > rlen)
+        rlenx = slen - rlen;
+
+      resultlen = rlen + rlenx + slen + slenx;
+      result = xtrycalloc (1, resultlen);
+      if (!result)
+        {
+          err = gpg_error_from_syserror ();
+          goto leave;
+        }
+      memcpy (result + rlenx, rval, rlen);
+      memcpy (result + rlenx + rlen + slenx, sval, slen);
+      xfree (outdata);
+      outdata = result;
+      outdatalen = resultlen;
+    }
+  else
+    {
+    bad_der:
+      err = gpg_error (GPG_ERR_CARD);
+      log_error ("piv: response does not contain a proper result\n");
+      goto leave;
+    }
+
+ leave:
+  if (err)
+    {
+      xfree (outdata);
+      *r_outdata = NULL;
+      *r_outdatalen = 0;
+    }
+  else
+    {
+      *r_outdata = outdata;
+      *r_outdatalen = outdatalen;
+    }
+  return err;
+}
+
+
+/* Select the PIV application on the card in SLOT.  This function must
+ * be used before any other PIV application functions. */
+gpg_error_t
+app_select_piv (app_t app)
+{
+  static char const aid[] = { 0xA0, 0x00, 0x00, 0x03, 0x08, /* RID=NIST */
+                              0x00, 0x00, 0x10, 0x00        /* PIX=PIV  */ };
+  int slot = app->slot;
+  gpg_error_t err;
+  unsigned char *apt = NULL;
+  size_t aptlen;
+  const unsigned char *s;
+  size_t n;
+
+  /* Note that we select using the AID without the 2 octet version
+   * number.  This allows for better reporting of future specs.  We
+   * need to use the use-zero-for-P2-flag.  */
+  err = iso7816_select_application_ext (slot, aid, sizeof aid, 0x0001,
+                                        &apt, &aptlen);
+  if (err)
+    goto leave;
+
+  app->apptype = "PIV";
+  app->did_chv1 = 0;
+  app->did_chv2 = 0;
+  app->did_chv3 = 0;
+  app->app_local = NULL;
+
+  /* Check the Application Property Template.  */
+  if (opt.verbose)
+    {
+      /* We  use a separate log_info to avoid the "DBG:" prefix.  */
+      log_info ("piv: APT=");
+      log_printhex (apt, aptlen, "");
+    }
+
+  s = find_tlv (apt, aptlen, 0x4F, &n);
+  if (!s || n != 6 || memcmp (s, aid+5, 4))
+    {
+      /* The PIX does not match.  */
+      log_error ("piv: missing or invalid DO 0x4F in APT\n");
+      err = gpg_error (GPG_ERR_CARD);
+      goto leave;
+    }
+  if (s[4] != 1 || s[5] != 0)
+    {
+      log_error ("piv: unknown PIV version %u.%u\n", s[4], s[5]);
+      err = gpg_error (GPG_ERR_CARD);
+      goto leave;
+    }
+  app->card_version = ((s[4] << 8) | s[5]);
+
+  s = find_tlv (apt, aptlen, 0x79, &n);
+  if (!s || n < 7)
+    {
+      log_error ("piv: missing or invalid DO 0x79 in APT\n");
+      err = gpg_error (GPG_ERR_CARD);
+      goto leave;
+    }
+  s = find_tlv (s, n, 0x4F, &n);
+  if (!s || n != 5 || memcmp (s, aid, 5))
+    {
+      /* The RID does not match.  */
+      log_error ("piv: missing or invalid DO 0x79.4F in APT\n");
+      err = gpg_error (GPG_ERR_CARD);
+      goto leave;
+    }
+
+  app->app_local = xtrycalloc (1, sizeof *app->app_local);
+  if (!app->app_local)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+
+  /* FIXME: Parse the optional and conditional DOs in the APT.  */
+
+  if (opt.verbose)
+    dump_all_do (slot);
+
+  app->fnc.deinit = do_deinit;
+  app->fnc.learn_status = do_learn_status;
+  app->fnc.readcert = do_readcert;
+  app->fnc.readkey = NULL;
+  app->fnc.getattr = do_getattr;
+  /* app->fnc.setattr = do_setattr; */
+  /* app->fnc.writecert = do_writecert; */
+  /* app->fnc.writekey = do_writekey; */
+  /* app->fnc.genkey = do_genkey; */
+  /* app->fnc.sign = do_sign; */
+  app->fnc.auth = do_auth;
+  /* app->fnc.decipher = do_decipher; */
+  /* app->fnc.change_pin = do_change_pin; */
+  /* app->fnc.check_pin = do_check_pin; */
+
+
+leave:
+  xfree (apt);
+  if (err)
+    do_deinit (app);
+  return err;
+}
diff --git a/scd/app.c b/scd/app.c
index d16300e..800c954 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -211,6 +211,60 @@ app_new_register (int slot, ctrl_t ctrl, const char *name,
   if (!want_undefined)
     {
       err = iso7816_select_file (slot, 0x3F00, 1);
+      if (gpg_err_code (err) == GPG_ERR_CARD)
+        {
+          /* Might be SW==0x7D00.  Let's test whether it is a Yubikey
+           * by selecting its manager application and then reading the
+           * config.  */
+          static char const yk_aid[] =
+            { 0xA0, 0x00, 0x00, 0x05, 0x27, 0x47, 0x11, 0x17 }; /*MGR*/
+          unsigned char *buf;
+          size_t buflen;
+          const unsigned char *s0, *s1;
+          size_t n;
+
+          if (!iso7816_select_application (slot, yk_aid, sizeof yk_aid,
+                                           0x0001)
+              && !iso7816_apdu_direct (slot, "\x00\x1d\x00\x00\x00", 5, 0,
+                                       NULL, &buf, &buflen))
+            {
+              if (opt.verbose)
+                {
+                  log_info ("Yubico: config=");
+                  log_printhex (buf, buflen, "");
+                }
+
+              /* We skip the first byte which seems to be the total
+               * length of the config data.  */
+              if (buflen > 1)
+                {
+                  s0 = find_tlv (buf+1, buflen-1, 0x04, &n);  /* Form factor */
+                  if (s0 && n == 1)
+                    {
+                      s1 = find_tlv (buf+1, buflen-1, 0x02, &n);  /* Serial */
+                      if (s1 && n >= 4)
+                        {
+                          app->serialno = xtrymalloc (3 + 1 + n);
+                          if (app->serialno)
+                            {
+                              app->serialnolen = 3 + 1 + n;
+                              app->serialno[0] = 0xff;
+                              app->serialno[1] = 0x02;
+                              app->serialno[2] = 0x0;
+                              app->serialno[3] = *s0;
+                              memcpy (app->serialno + 4, s1, n);
+                              /* Note that we do not clear the error
+                               * so that no further serial number
+                               * testing is done.  After all we just
+                               * set the serial number.  */
+                            }
+                        }
+                    }
+                }
+              xfree (buf);
+            }
+        }
+
       if (!err)
         err = iso7816_select_file (slot, 0x2F02, 0);
       if (!err)
@@ -270,6 +324,8 @@ app_new_register (int slot, ctrl_t ctrl, const char *name,
   if (err && is_app_allowed ("openpgp")
           && (!name || !strcmp (name, "openpgp")))
     err = app_select_openpgp (app);
+  if (err && is_app_allowed ("piv") && (!name || !strcmp (name, "piv")))
+    err = app_select_piv (app);
   if (err && is_app_allowed ("nks") && (!name || !strcmp (name, "nks")))
     err = app_select_nks (app);
   if (err && is_app_allowed ("p15") && (!name || !strcmp (name, "p15")))
@@ -409,6 +465,7 @@ get_supported_applications (void)
 {
   const char *list[] = {
     "openpgp",
+    "piv",
     "nks",
     "p15",
     "geldkarte",
@@ -509,6 +566,7 @@ release_application (app_t app, int locked_already)
      FF 00 00 = For serial numbers starting with an FF
      FF 01 00 = Some german p15 cards return an empty serial number so the
                 serial number from the EF(TokenInfo) is used instead.
+     FF 02 00 = Serial number from Yubikey config
      FF 7F 00 = No serialno.
 
      All other serial number not starting with FF are used as they are.

commit 70bb5c7931598590b1acfae90bf4657f5911d2d3
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 20 11:41:23 2019 +0100

    scd: One new and one improved 7816 function.
    
    * scd/apdu.c (apdu_send_direct): New arg R_SW.
    * scd/command.c (cmd_apdu): Ditto.
    * scd/iso7816.c (iso7816_apdu_direct): New arg R_SW.
    (iso7816_general_authenticate): New.
    * scd/app-nks.c (get_chv_status, get_nks_version): Pass NULL for new
    arg.
    --
    
    iso7816_general_authenticate will be used for the PIV card support.
    The new arg to iso7816_apdu_direct and apdu_send_direct allows to get
    the raw status word back without the need to handle an output buffer.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index f3e2a12..816938a 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -3063,19 +3063,25 @@ apdu_send_simple (int slot, int extended_mode,
 
 
 /* This is a more generic version of the apdu sending routine.  It
-   takes an already formatted APDU in APDUDATA or length APDUDATALEN
-   and returns with an APDU including the status word.  With
-   HANDLE_MORE set to true this function will handle the MORE DATA
-   status and return all APDUs concatenated with one status word at
-   the end.  If EXTENDED_LENGTH is != 0 extended lengths are allowed
-   with a max. result data length of EXTENDED_LENGTH bytes.  The
-   function does not return a regular status word but 0 on success.
-   If the slot is locked, the function returns immediately with an
-   error.  */
+ * takes an already formatted APDU in APDUDATA or length APDUDATALEN
+ * and returns with an APDU including the status word.  With
+ * HANDLE_MORE set to true this function will handle the MORE DATA
+ * status and return all APDUs concatenated with one status word at
+ * the end.  If EXTENDED_LENGTH is != 0 extended lengths are allowed
+ * with a max. result data length of EXTENDED_LENGTH bytes.  The
+ * function does not return a regular status word but 0 on success.
+ * If the slot is locked, the function returns immediately with an
+ * error.
+ *
+ * Out of historical reasons the function returns 0 on success and
+ * outs the status word at the end of the result to be able to get the
+ * status word in the case of a not provided RETBUF, R_SW can be used
+ * to store the SW.  But note that R_SW qill only be set if the
+ * function returns 0. */
 int
 apdu_send_direct (int slot, size_t extended_length,
                   const unsigned char *apdudata, size_t apdudatalen,
-                  int handle_more,
+                  int handle_more, unsigned int *r_sw,
                   unsigned char **retbuf, size_t *retbuflen)
 {
 #define SHORT_RESULT_BUFFER_SIZE 258
@@ -3282,9 +3288,13 @@ apdu_send_direct (int slot, size_t extended_length,
       (*retbuf)[(*retbuflen)++] = sw;
     }
 
+  if (r_sw)
+    *r_sw = sw;
+
   if (DBG_CARD_IO && retbuf)
     log_printhex (*retbuf, *retbuflen, "      dump: ");
 
+
   return 0;
 }
 
diff --git a/scd/apdu.h b/scd/apdu.h
index 8621ddc..1392aab 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -138,7 +138,7 @@ int apdu_send_le (int slot, int extended_mode,
                   unsigned char **retbuf, size_t *retbuflen);
 int apdu_send_direct (int slot, size_t extended_length,
                       const unsigned char *apdudata, size_t apdudatalen,
-                      int handle_more,
+                      int handle_more, unsigned int *r_sw,
                       unsigned char **retbuf, size_t *retbuflen);
 const char *apdu_get_reader_name (int slot);
 
diff --git a/scd/app-nks.c b/scd/app-nks.c
index 9e720f0..801ab90 100644
--- a/scd/app-nks.c
+++ b/scd/app-nks.c
@@ -273,7 +273,7 @@ get_chv_status (app_t app, int sigg, int pwid)
   command[3] = pwid;
 
   if (apdu_send_direct (app->slot, 0, (unsigned char *)command,
-                        4, 0, &result, &resultlen))
+                        4, 0, NULL, &result, &resultlen))
     rc = -1; /* Error. */
   else if (resultlen < 2)
     rc = -1; /* Error. */
@@ -1300,7 +1300,7 @@ get_nks_version (int slot)
   int type;
 
   if (iso7816_apdu_direct (slot, "\x80\xaa\x06\x00\x00", 5, 0,
-                           &result, &resultlen))
+                           NULL, &result, &resultlen))
     return 2; /* NKS 2 does not support this command.  */
 
   /* Example value:    04 11 19 22 21 6A 20 80 03 03 01 01 01 00 00 00
diff --git a/scd/command.c b/scd/command.c
index 9df2611..ea4ccbc 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -333,7 +333,7 @@ static const char hlp_learn[] =
   "or a \"CANCEL\" to force the function to terminate with a Cancel\n"
   "error message.\n"
   "\n"
-  "With the option --keypairinfo only KEYPARIINFO lstatus lines are\n"
+  "With the option --keypairinfo only KEYPARIINFO status lines are\n"
   "returned.\n"
   "\n"
   "The response of this command is a list of status lines formatted as\n"
@@ -346,6 +346,7 @@ static const char hlp_learn[] =
   "    P15     = PKCS-15 structure used\n"
   "    DINSIG  = DIN SIG\n"
   "    OPENPGP = OpenPGP card\n"
+  "    PIV     = PIV card\n"
   "    NKS     = NetKey card\n"
   "\n"
   "are implemented.  These strings are aliases for the AID\n"
@@ -1663,7 +1664,7 @@ cmd_apdu (assuan_context_t ctx, char *line)
 
       rc = apdu_send_direct (app->slot, exlen,
                              apdu, apdulen, handle_more,
-                             &result, &resultlen);
+                             NULL, &result, &resultlen);
       if (rc)
         log_error ("apdu_send_direct failed: %s\n", gpg_strerror (rc));
       else
diff --git a/scd/iso7816.c b/scd/iso7816.c
index 43c0bcd..c8a2138 100644
--- a/scd/iso7816.c
+++ b/scd/iso7816.c
@@ -50,6 +50,7 @@
 #define CMD_PUT_DATA    0xDA
 #define CMD_MSE         0x22
 #define CMD_PSO         0x2A
+#define CMD_GENERAL_AUTHENTICATE  0x87
 #define CMD_INTERNAL_AUTHENTICATE 0x88
 #define CMD_GENERATE_KEYPAIR      0x47
 #define CMD_GET_CHALLENGE         0x84
@@ -225,24 +226,28 @@ iso7816_list_directory (int slot, int list_dirs,
    internally.  The return value is a gpg error code (i.e. a mapped
    status word).  This is basically the same as apdu_send_direct but
    it maps the status word and does not return it in the result
-   buffer.  */
+   buffer.  However, it R_SW is not NULL the status word is stored
+   R_SW for closer inspection. */
 gpg_error_t
 iso7816_apdu_direct (int slot, const void *apdudata, size_t apdudatalen,
-                     int handle_more,
+                     int handle_more, unsigned int *r_sw,
                      unsigned char **result, size_t *resultlen)
 {
-  int sw;
+  int sw, sw2;
 
-  if (!result || !resultlen)
-    return gpg_error (GPG_ERR_INV_VALUE);
-  *result = NULL;
-  *resultlen = 0;
+  if (result)
+    {
+      *result = NULL;
+      *resultlen = 0;
+    }
 
   sw = apdu_send_direct (slot, 0, apdudata, apdudatalen, handle_more,
-                         result, resultlen);
+                         &sw2, result, resultlen);
   if (!sw)
     {
-      if (*resultlen < 2)
+      if (!result)
+        sw = sw2;
+      else if (*resultlen < 2)
         sw = SW_HOST_GENERAL_ERROR;
       else
         {
@@ -251,13 +256,15 @@ iso7816_apdu_direct (int slot, const void *apdudata, size_t apdudatalen,
           (*resultlen)--;
         }
     }
-  if (sw != SW_SUCCESS)
+  if (sw != SW_SUCCESS && result)
     {
       /* Make sure that pending buffers are released. */
       xfree (*result);
       *result = NULL;
       *resultlen = 0;
     }
+  if (r_sw)
+    *r_sw = sw;
   return map_sw (sw);
 }
 
@@ -621,7 +628,7 @@ iso7816_decipher (int slot, int extended_mode,
 }
 
 
-/*  For LE see do_generate_keypair.  */
+/* For LE see do_generate_keypair.  */
 gpg_error_t
 iso7816_internal_authenticate (int slot, int extended_mode,
                                const unsigned char *data, size_t datalen,
@@ -658,6 +665,44 @@ iso7816_internal_authenticate (int slot, int extended_mode,
 }
 
 
+/* For LE see do_generate_keypair.  */
+gpg_error_t
+iso7816_general_authenticate (int slot, int extended_mode,
+                              int algoref, int keyref,
+                              const unsigned char *data, size_t datalen,
+                              int le,
+                              unsigned char **result, size_t *resultlen)
+{
+  int sw;
+
+  if (!data || !datalen || !result || !resultlen)
+    return gpg_error (GPG_ERR_INV_VALUE);
+  *result = NULL;
+  *resultlen = 0;
+
+  if (!extended_mode)
+    le = 256;  /* Ignore provided Le and use what apdu_send uses. */
+  else if (le >= 0 && le < 256)
+    le = 256;
+
+  sw = apdu_send_le (slot, extended_mode,
+                     0x00, CMD_GENERAL_AUTHENTICATE, algoref, keyref,
+                     datalen, (const char*)data,
+                     le,
+                     result, resultlen);
+  if (sw != SW_SUCCESS)
+    {
+      /* Make sure that pending buffers are released. */
+      xfree (*result);
+      *result = NULL;
+      *resultlen = 0;
+      return map_sw (sw);
+    }
+
+  return 0;
+}
+
+
 /* LE is the expected return length.  This is usually 0 except if
    extended length mode is used and more than 256 byte will be
    returned.  In that case a value of -1 uses a large default
diff --git a/scd/iso7816.h b/scd/iso7816.h
index 332fc0e..4a366e6 100644
--- a/scd/iso7816.h
+++ b/scd/iso7816.h
@@ -63,7 +63,7 @@ gpg_error_t iso7816_list_directory (int slot, int list_dirs,
                                     unsigned char **result, size_t *resultlen);
 gpg_error_t iso7816_apdu_direct (int slot,
                                  const void *apdudata, size_t apdudatalen,
-                                 int handle_more,
+                                 int handle_more, unsigned int *r_sw,
                                  unsigned char **result, size_t *resultlen);
 gpg_error_t iso7816_check_pinpad (int slot, int command,
                                   pininfo_t *pininfo);
@@ -104,6 +104,13 @@ gpg_error_t iso7816_internal_authenticate (int slot, int extended_mode,
                                    const unsigned char *data, size_t datalen,
                                    int le,
                                    unsigned char **result, size_t *resultlen);
+gpg_error_t iso7816_general_authenticate (int slot, int extended_mode,
+                                          int algoref, int keyref,
+                                          const unsigned char *data,
+                                          size_t datalen,
+                                          int le,
+                                          unsigned char **result,
+                                          size_t *resultlen);
 gpg_error_t iso7816_generate_keypair (int slot, int extended_mode,
                                     const char *data, size_t datalen,
                                     int le,

-----------------------------------------------------------------------

Summary of changes:
 scd/Makefile.am  |    3 +-
 scd/apdu.c       |   30 +-
 scd/apdu.h       |    2 +-
 scd/app-common.h |    3 +
 scd/app-nks.c    |    4 +-
 scd/app-piv.c    | 1238 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 scd/app.c        |   58 +++
 scd/command.c    |    5 +-
 scd/iso7816.c    |   67 ++-
 scd/iso7816.h    |    9 +-
 10 files changed, 1391 insertions(+), 28 deletions(-)
 create mode 100644 scd/app-piv.c


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 21 15:04:21 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 21 Jan 2019 15:04:21 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-322-gfa9d703
Message-ID: <E1glaBb-0006u2-Ab@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  fa9d703de5c70ae925e8ca6604073506f24d641a (commit)
       via  29929e65521279eabc98a67c766fe485057405a9 (commit)
      from  ec56996029d95d4bd26e1badfe207232270c6247 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fa9d703de5c70ae925e8ca6604073506f24d641a
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 21 15:01:45 2019 +0100

    scd: Support CHV-STATUS and CHECKPIN for PIV.
    
    * scd/app-piv.c (parse_pin_keyref): New.
    (get_chv_status): New.
    (do_getattr): Add name CHV-STATUS.
    (verify_pin): Add arg keyref to support other PINs.
    (do_change_pin): New.  Right now limited to --clear.
    (do_check_pin): New.
    (app_select_piv): Register new commands.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/app-piv.c b/scd/app-piv.c
index 9b40477..011b552 100644
--- a/scd/app-piv.c
+++ b/scd/app-piv.c
@@ -364,6 +364,25 @@ dump_all_do (int slot)
 }
 
 
+/* Parse the key reference KEYREFSTR which is expected to hold a key
+ * reference for a PIN object.  Return the one octet keyref or -1 for
+ * an invalid reference.  */
+static int
+parse_pin_keyref (const char *keyrefstr)
+{
+  if (!keyrefstr)
+    return -1;
+  else if (!ascii_strcasecmp (keyrefstr, "PIV.00"))
+    return 0x00;
+  else if (!ascii_strcasecmp (keyrefstr, "PIV.80"))
+    return 0x80;
+  else if (!ascii_strcasecmp (keyrefstr, "PIV.81"))
+    return 0x81;
+  else
+    return -1;
+}
+
+
 /* Return an allocated string with the serial number in a format to be
  * show to the user.  With FAILMODE is true return NULL if such an
  * abbreviated S/N is not available, else return the full serial
@@ -396,6 +415,47 @@ get_dispserialno (app_t app, int failmode)
 }
 
 
+/* The verify command can be used to retrieve the security status of
+ * the card.  Given the PIN name (e.g. "PIV.80" for thge application
+ * pin, a status is returned:
+ *
+ *        -1 = Error retrieving the data,
+ *        -2 = No such PIN,
+ *        -3 = PIN blocked,
+ *        -5 = Verify still valid,
+ *    n >= 0 = Number of verification attempts left.
+ */
+static int
+get_chv_status (app_t app, const char *keyrefstr)
+{
+  unsigned char apdu[4];
+  unsigned int sw;
+  int result;
+  int keyref;
+
+  keyref = parse_pin_keyref (keyrefstr);
+  if (!keyrefstr)
+    return -1;
+
+  apdu[0] = 0x00;
+  apdu[1] = ISO7816_VERIFY;
+  apdu[2] = 0x00;
+  apdu[3] = keyref;
+  if (!iso7816_apdu_direct (app->slot, apdu, 4, 0, &sw, NULL, NULL))
+    result = -5; /* No need to verification.  */
+  else if (sw == 0x6a88)
+    result = -2; /* No such PIN.  */
+  else if (sw == 0x6983)
+    result = -3; /* PIN is blocked.  */
+  else if ((sw & 0xfff0) == 0x63C0)
+    result = (sw & 0x000f);
+  else
+    result = -1; /* Error.  */
+
+  return result;
+}
+
+
 /* Implementation of the GETATTR command.  This is similar to the
  * LEARN command but returns only one value via status lines.  */
 static gpg_error_t
@@ -408,7 +468,8 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
   } table[] = {
     { "SERIALNO",     0x0000, -1 },
     { "$AUTHKEYID",   0x0000, -2 }, /* Default key for ssh.  */
-    { "$DISPSERIALNO",0x0000, -3 }
+    { "$DISPSERIALNO",0x0000, -3 },
+    { "CHV-STATUS",   0x0000, -4 }
   };
   gpg_error_t err = 0;
   int idx;
@@ -450,6 +511,16 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
       else
         err = gpg_error (GPG_ERR_INV_NAME);  /* No Abbreviated S/N.  */
     }
+  else if (table[idx].special == -4) /* CHV-STATUS */
+    {
+      int tmp[3];
+
+      tmp[0] = get_chv_status (app, "PIV.00");
+      tmp[1] = get_chv_status (app, "PIV.80");
+      tmp[2] = get_chv_status (app, "PIV.81");
+      err = send_status_printf (ctrl, table[idx].name, "%d %d %d",
+                                tmp[0], tmp[1], tmp[2]);
+    }
   else
     {
       relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &err);
@@ -849,27 +920,28 @@ make_prompt (app_t app, int remaining, const char *firstline)
 }
 
 
-
-/* Verify the Application PIN for use with data object DOBJ.  */
+/* Verify the Application PIN KEYREF.  */
 static gpg_error_t
-verify_pin (app_t app, data_object_t dobj,
+verify_pin (app_t app, int keyref,
             gpg_error_t (*pincb)(void*,const char *,char **), void *pincb_arg)
 {
   gpg_error_t err;
   unsigned char apdu[4];
   unsigned int sw;
   int remaining;
+  const char *label;
   char *prompt;
   char *pinvalue = NULL;
   unsigned int pinlen;
   char pinbuffer[8];
+  int minlen, maxlen, padding, onlydigits;
 
   /* First check whether a verify is at all needed.  This is done with
    * P1 being 0 and no Lc and command data send.  */
   apdu[0] = 0x00;
   apdu[1] = ISO7816_VERIFY;
   apdu[2] = 0x00;
-  apdu[3] = 0x80;
+  apdu[3] = keyref;
   if (!iso7816_apdu_direct (app->slot, apdu, 4, 0, &sw, NULL, NULL))
     {
       /* No need to verification.  */
@@ -881,11 +953,46 @@ verify_pin (app_t app, data_object_t dobj,
     remaining = -1;
 
   if (remaining != -1)
-    log_debug ("piv: PIN for %s has %d attempts left\n",
-               dobj->keyref, remaining);
+    log_debug ("piv: PIN %2X has %d attempts left\n", keyref, remaining);
+
+  switch (keyref)
+    {
+    case 0x00:
+      minlen = 6;
+      maxlen = 8;
+      padding = 1;
+      onlydigits = 1;
+      label = _("||Please enter the Global-PIN of your PIV card");
+      break;
+    case 0x80:
+      minlen = 6;
+      maxlen = 8;
+      padding = 1;
+      onlydigits = 1;
+      label = _("||Please enter the PIN of your PIV card");
+      break;
+    case 0x81:
+      minlen = 8;
+      maxlen = 8;
+      padding = 0;
+      onlydigits = 0;
+      label = _("||Please enter the Unblocking Key of your PIV card");
+      break;
+
+    case 0x96:
+    case 0x97:
+    case 0x98:
+    case 0x9B:
+      return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+
+    default:
+      return gpg_error (GPG_ERR_INV_ID);
+    }
+  log_assert (sizeof pinbuffer >= maxlen);
+
 
   /* Ask for the PIN.  */
-  prompt = make_prompt (app, remaining, _("||Please enter your PIV PIN"));
+  prompt = make_prompt (app, remaining, label);
   err = pincb (pincb_arg, prompt, &pinvalue);
   xfree (prompt);
   prompt = NULL;
@@ -896,24 +1003,22 @@ verify_pin (app_t app, data_object_t dobj,
     }
 
   pinlen = pinvalue? strlen (pinvalue) : 0;
-  if (pinlen < 6)
+  if (pinlen < minlen)
     {
-      log_error (_("PIN for is too short;"
-                   " minimum length is %d\n"), 6);
+      log_error (_("PIN for is too short; minimum length is %d\n"), minlen);
       if (pinvalue)
         wipememory (pinvalue, pinlen);
       xfree (pinvalue);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
-  if (pinlen > sizeof pinbuffer)
+  if (pinlen > maxlen)
     {
-      log_error (_("PIN for is too long;"
-                   " maximum length is %d\n"), (int)sizeof pinbuffer);
+      log_error (_("PIN for is too long; maximum length is %d\n"), maxlen);
       wipememory (pinvalue, pinlen);
       xfree (pinvalue);
       return gpg_error (GPG_ERR_BAD_PIN);
     }
-  if (strspn (pinvalue, "0123456789") != pinlen)
+  if (onlydigits && strspn (pinvalue, "0123456789") != pinlen)
     {
       log_error (_("PIN has invalid characters; only digits are allowed\n"));
       wipememory (pinvalue, pinlen);
@@ -921,20 +1026,102 @@ verify_pin (app_t app, data_object_t dobj,
       return gpg_error (GPG_ERR_BAD_PIN);
     }
   memcpy (pinbuffer, pinvalue, pinlen);
-  memset (pinbuffer + pinlen, 0xff, sizeof(pinbuffer) - pinlen);
-  wipememory (pinvalue, pinlen);
+  if (padding)
+    {
+      memset (pinbuffer + pinlen, 0xff, maxlen - pinlen);
+      wipememory (pinvalue, pinlen);
+      pinlen = maxlen;
+    }
+  else
+    wipememory (pinvalue, pinlen);
   xfree (pinvalue);
 
-  err = iso7816_verify (app->slot, 0x80,
-                        pinbuffer, sizeof pinbuffer);
-  wipememory (pinbuffer, sizeof pinbuffer);
+  err = iso7816_verify (app->slot, keyref, pinbuffer, pinlen);
+  wipememory (pinbuffer, pinlen);
   if (err)
-    log_error ("PIN verification failed: %s\n", gpg_strerror (err));
+    log_error ("PIN %02X verification failed: %s\n", keyref,gpg_strerror (err));
 
   return err;
 }
 
 
+/* Handle the PASSWD command.  Valid values for PWIDSTR are
+ * key references related to PINs; in particular:
+ *   PIV.00 - The Global PIN
+ *   PIV.80 - The Application PIN
+ *   PIV.81 - The PIN Unblocking key
+ * The supported flags are:
+ *   APP_CHANGE_FLAG_CLEAR   Clear the PIN verification state.
+ */
+static gpg_error_t
+do_change_pin (app_t app, ctrl_t ctrl, const char *pwidstr,
+               unsigned int flags,
+               gpg_error_t (*pincb)(void*, const char *, char **),
+               void *pincb_arg)
+{
+  gpg_error_t err;
+  int keyref;
+  unsigned char apdu[4];
+
+  char *newpin = NULL;
+  char *oldpin = NULL;
+  size_t newpinlen;
+  size_t oldpinlen;
+  const char *newdesc;
+  int pwid;
+  pininfo_t pininfo;
+
+  (void)ctrl;
+
+  /* The minimum and maximum lengths are enforced by PIV.  */
+  memset (&pininfo, 0, sizeof pininfo);
+  pininfo.minlen = 6;
+  pininfo.maxlen = 8;
+
+  keyref = parse_pin_keyref (pwidstr);
+  if (keyref == -1)
+    return gpg_error (GPG_ERR_INV_ID);
+
+  if ((flags & ~APP_CHANGE_FLAG_CLEAR))
+    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+
+  /* First see whether the special --clear mode has been requested.  */
+  if ((flags & APP_CHANGE_FLAG_CLEAR))
+    {
+      apdu[0] = 0x00;
+      apdu[1] = ISO7816_VERIFY;
+      apdu[2] = 0xff;
+      apdu[3] = keyref;
+      err = iso7816_apdu_direct (app->slot, apdu, 4, 0, NULL, NULL, NULL);
+      goto leave;
+    }
+
+  err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+
+ leave:
+  xfree (oldpin);
+  xfree (newpin);
+  return err;
+}
+
+
+/* Perform a simple verify operation for the PIN specified by PWIDSTR.
+ * For valid values see do_change_pin.  */
+static gpg_error_t
+do_check_pin (app_t app, const char *pwidstr,
+              gpg_error_t (*pincb)(void*, const char *, char **),
+              void *pincb_arg)
+{
+  int keyref;
+
+  keyref = parse_pin_keyref (pwidstr);
+  if (keyref == -1)
+    return gpg_error (GPG_ERR_INV_ID);
+
+  return verify_pin (app, keyref, pincb, pincb_arg);
+}
+
+
 /* Compute a digital signature using the GENERAL AUTHENTICATE command
  * on INDATA which is expected to be the raw message digest.  The
  * KEYIDSTR has the key reference or its OID (e.g. "PIV.9A").  The
@@ -1045,8 +1232,8 @@ do_auth (app_t app, const char *keyidstr,
       goto leave;
     }
 
-  /* Now verify the PIN.  */
-  err = verify_pin (app, dobj, pincb, pincb_arg);
+  /* Now verify the Application PIN.  */
+  err = verify_pin (app, 0x80, pincb, pincb_arg);
   if (err)
     return err;
 
@@ -1226,8 +1413,8 @@ app_select_piv (app_t app)
   /* app->fnc.sign = do_sign; */
   app->fnc.auth = do_auth;
   /* app->fnc.decipher = do_decipher; */
-  /* app->fnc.change_pin = do_change_pin; */
-  /* app->fnc.check_pin = do_check_pin; */
+  app->fnc.change_pin = do_change_pin;
+  app->fnc.check_pin = do_check_pin;
 
 
 leave:

commit 29929e65521279eabc98a67c766fe485057405a9
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 21 14:06:51 2019 +0100

    scd: Add option --clear to PASSWD.
    
    * scd/command.c (cmd_passwd): Add option --clear.
    (send_status_printf): New.
    * scd/app-common.h (APP_CHANGE_FLAG_CLEAR): New.
    * scd/app-nks.c (do_change_pin): Return an error if that option is
    used.
    * scd/app-openpgp.c (do_change_pin): Ditto.
    --
    
    Card application may support this option to clear the PIN verification
    status of a specific PIN.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/po/Makevars b/po/Makevars
index 90b0c5b..20d6ae9 100644
--- a/po/Makevars
+++ b/po/Makevars
@@ -63,6 +63,7 @@ XGETTEXT_OPTIONS = \
 	--flag=write_status_printf:2:c-format    \
 	--flag=kbxd_print_status:3:c-format      \
 	--flag=gpgconf_write_status:2:c-format   \
+        --flag=send_status_printf:3:c-format     \
 	--flag=wks_write_status:2:c-format
 
 
diff --git a/scd/app-common.h b/scd/app-common.h
index ff58318..b1661b5 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -26,8 +26,9 @@
 #include <ksba.h>
 
 
-#define APP_CHANGE_FLAG_RESET    1
-#define APP_CHANGE_FLAG_NULLPIN  2
+#define APP_CHANGE_FLAG_RESET    1  /* PIN Reset mode.  */
+#define APP_CHANGE_FLAG_NULLPIN  2  /* NULL PIN mode.  */
+#define APP_CHANGE_FLAG_CLEAR    4  /* Clear the given PIN.  */
 
 /* Bit flags set by the decipher function into R_INFO.  */
 #define APP_DECIPHER_INFO_NOPAD  1  /* Padding has been removed.  */
diff --git a/scd/app-nks.c b/scd/app-nks.c
index 801ab90..0f38e7c 100644
--- a/scd/app-nks.c
+++ b/scd/app-nks.c
@@ -1169,6 +1169,9 @@ do_change_pin (app_t app, ctrl_t ctrl,  const char *pwidstr,
   if (!newdesc)
     return gpg_error (GPG_ERR_INV_ID);
 
+  if ((flags & APP_CHANGE_FLAG_CLEAR))
+    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+
   err = switch_application (app, is_sigg);
   if (err)
     return err;
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index f25a360..fddc3b8 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -2602,10 +2602,14 @@ do_change_pin (app_t app, ctrl_t ctrl,  const char *chvnostr,
   int pinlen = 0;
 
   (void)ctrl;
+
   memset (&pininfo, 0, sizeof pininfo);
   pininfo.fixedlen = -1;
   pininfo.minlen = minlen;
 
+  if ((flags & APP_CHANGE_FLAG_CLEAR))
+    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+
   if (reset_mode && chvno == 3)
     {
       rc = gpg_error (GPG_ERR_INV_ID);
diff --git a/scd/app.c b/scd/app.c
index 800c954..8e09555 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -997,7 +997,7 @@ app_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr, int reset_mode,
 }
 
 
-/* Perform a VERIFY operation without doing anything lese.  This may
+/* Perform a VERIFY operation without doing anything else.  This may
    be used to initialize a the PIN cache for long lasting other
    operations.  Its use is highly application dependent. */
 gpg_error_t
diff --git a/scd/command.c b/scd/command.c
index ea4ccbc..044831f 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -1215,12 +1215,13 @@ cmd_random (assuan_context_t ctx, char *line)
 
 

 static const char hlp_passwd[] =
-  "PASSWD [--reset] [--nullpin] <chvno>\n"
+  "PASSWD [--reset] [--nullpin] [--clear] <chvno>\n"
   "\n"
   "Change the PIN or, if --reset is given, reset the retry counter of\n"
   "the card holder verification vector CHVNO.  The option --nullpin is\n"
-  "used for TCOS cards to set the initial PIN.  The format of CHVNO\n"
-  "depends on the card application.";
+  "used for TCOS cards to set the initial PIN.  The option --clear clears\n"
+  "the security status associated with the PIN so that the PIN needs to\n"
+  "be presented again. The format of CHVNO depends on the card application.";
 static gpg_error_t
 cmd_passwd (assuan_context_t ctx, char *line)
 {
@@ -1233,6 +1234,8 @@ cmd_passwd (assuan_context_t ctx, char *line)
     flags |= APP_CHANGE_FLAG_RESET;
   if (has_option (line, "--nullpin"))
     flags |= APP_CHANGE_FLAG_NULLPIN;
+  if (has_option (line, "--clear"))
+    flags |= APP_CHANGE_FLAG_CLEAR;
 
   line = skip_options (line);
 
@@ -1243,6 +1246,11 @@ cmd_passwd (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
+  /* Do not allow other flags aside of --clear. */
+  if ((flags & APP_CHANGE_FLAG_CLEAR) && (flags & ~APP_CHANGE_FLAG_CLEAR))
+    return set_error (GPG_ERR_UNSUPPORTED_OPERATION,
+                      "--clear used with other options");
+
   if ((rc = open_card (ctrl)))
     return rc;
 
@@ -1922,6 +1930,26 @@ send_status_direct (ctrl_t ctrl, const char *keyword, const char *args)
 }
 
 
+/* This status functions expects a printf style format string.  No
+ * filtering of the data is done instead the orintf formatted data is
+ * send using assuan_send_status. */
+gpg_error_t
+send_status_printf (ctrl_t ctrl, const char *keyword, const char *format, ...)
+{
+  gpg_error_t err;
+  va_list arg_ptr;
+  assuan_context_t ctx;
+
+  if (!ctrl || !ctrl->server_local || !(ctx = ctrl->server_local->assuan_ctx))
+    return 0;
+
+  va_start (arg_ptr, format);
+  err = vprint_assuan_status (ctx, keyword, format, arg_ptr);
+  va_end (arg_ptr);
+  return err;
+}
+
+
 void
 popup_prompt (void *opaque, int on)
 {
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 238e6a8..73589ad 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -123,6 +123,9 @@ int  scd_command_handler (ctrl_t, int);
 void send_status_info (ctrl_t ctrl, const char *keyword, ...)
      GPGRT_ATTR_SENTINEL(1);
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
+gpg_error_t send_status_printf (ctrl_t ctrl, const char *keyword,
+                                const char *format, ...) GPGRT_ATTR_PRINTF(3,4);
+
 void popup_prompt (void *opaque, int on);
 void send_client_notifications (app_t app, int removal);
 void scd_kick_the_loop (void);

-----------------------------------------------------------------------

Summary of changes:
 po/Makevars       |   1 +
 scd/app-common.h  |   5 +-
 scd/app-nks.c     |   3 +
 scd/app-openpgp.c |   4 +
 scd/app-piv.c     | 237 ++++++++++++++++++++++++++++++++++++++++++++++++------
 scd/app.c         |   2 +-
 scd/command.c     |  34 +++++++-
 scd/scdaemon.h    |   3 +
 8 files changed, 258 insertions(+), 31 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 22 10:06:38 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 22 Jan 2019 10:06:38 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-325-gf97dc55
Message-ID: <E1gls12-0002Pk-Qq@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f97dc55ff1b041071bc3cbe98aa761bf77bb7ac8 (commit)
       via  e6d613711a327d63511601dd42aeff34e09ec95a (commit)
       via  03cf23b43ec5fea8a355d3ba2200e86a8efc589b (commit)
      from  fa9d703de5c70ae925e8ca6604073506f24d641a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f97dc55ff1b041071bc3cbe98aa761bf77bb7ac8
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 22 10:06:15 2019 +0100

    gpg: Stop early when trying to create a primary Elgamal key.
    
    * g10/misc.c (openpgp_pk_test_algo2): Add extra check.
    --
    
    The problem is that --key-gen --batch with a parameter file didn't
    detect that Elgamal is not capable of signing and so an error was only
    triggered at the time the self-signature was created.  See the code
    comment for details.
    
    GnuPG-bug-id: 4329
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/misc.c b/g10/misc.c
index f129e83..a3f0c67 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -723,6 +723,13 @@ openpgp_pk_test_algo2 (pubkey_algo_t algo, unsigned int use)
   if (!ga)
     return gpg_error (GPG_ERR_PUBKEY_ALGO);
 
+  /* Elgamal in OpenPGP used to support signing and Libgcrypt still
+   * does.  However, we removed the signing capability from gpg ages
+   * ago.  This function should reflect this so that errors are thrown
+   * early and not only when we try to sign using Elgamal.  */
+  if (ga == GCRY_PK_ELG && (use & (PUBKEY_USAGE_CERT | PUBKEY_USAGE_SIG)))
+    return gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
+
   /* Now check whether Libgcrypt has support for the algorithm.  */
   return gcry_pk_algo_info (ga, GCRYCTL_TEST_ALGO, NULL, &use_buf);
 }

commit e6d613711a327d63511601dd42aeff34e09ec95a
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 22 09:07:24 2019 +0100

    card-tool: Add skeleton for new tool
    
    * tools/gpg-card-tool.c: New.
    * tools/gpg-card-tool-w32info.rc: New.
    * tools/Makefile.am: Add new tool.
    --
    
    To support more cards than the OpenPGP card it is useful to have a
    separate tool.  It will have have the "gpg --card-edit" style
    interactive interface as well as direct command line options for all
    commands.  In a first step the OpenPGP card will be supported, to
    allow its use as an alternative to the gpg command, and the
    forthcoming PIV card support.
    
    The tool can be though as a direct interface to scdaemon.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/Makefile.am b/tools/Makefile.am
index e4fd81c..4833bff 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -20,14 +20,17 @@ EXTRA_DIST = \
 	Manifest watchgnupg.c no-libgcrypt.c \
 	addgnupghome applygnupgdefaults \
 	lspgpot mail-signed-keys convert-from-106 sockprox.c \
-	ccidmon.c ChangeLog-2011 gpg-connect-agent-w32info.rc
-
+	ccidmon.c ChangeLog-2011 \
+	gpg-connect-agent-w32info.rc \
+	gpg-card-tool-w32info.rc
 
 AM_CPPFLAGS =
 include $(top_srcdir)/am/cmacros.am
 
 if HAVE_W32_SYSTEM
-resource_objs += gpg-connect-agent-w32info.o
+gpg_connect_agent_rc_objs = gpg-connect-agent-w32info.o
+gpg_card_tool_rc_objs     = gpg-card-tool-w32info.o
+resource_objs += $(gpg_connect_agent_rc_objs) $(gpg_card_tool_rc_objs)
 endif
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(LIBASSUAN_CFLAGS)
@@ -48,7 +51,7 @@ endif
 
 libexec_PROGRAMS = gpg-wks-client gpg-pair-tool
 
-bin_PROGRAMS = gpgconf gpg-connect-agent ${symcryptrun}
+bin_PROGRAMS = gpgconf gpg-connect-agent gpg-card-tool ${symcryptrun}
 if !HAVE_W32_SYSTEM
 bin_PROGRAMS += watchgnupg gpgparsemail ${gpg_wks_server}
 endif
@@ -118,7 +121,14 @@ gpg_connect_agent_LDADD = ../common/libgpgrl.a $(common_libs) \
 	                  $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
                           $(GPG_ERROR_LIBS) \
                           $(LIBREADLINE) $(LIBINTL) $(NETLIBS) $(LIBICONV) \
-                          $(resource_objs)
+                          $(gpg_connect_agent_rc_objs)
+
+gpg_card_tool_SOURCES   = gpg-card-tool.c
+gpg_card_tool_LDADD     = ../common/libgpgrl.a $(common_libs) \
+	                  $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
+			  $(GPG_ERROR_LIBS) \
+                          $(LIBREADLINE) $(LIBINTL) $(NETLIBS) $(LIBICONV) \
+                          $(gpg_card_tool_rc_objs)
 
 
 if !DISABLE_REGEX
diff --git a/tools/gpg-connect-agent-w32info.rc b/tools/gpg-card-tool-w32info.rc
similarity index 83%
copy from tools/gpg-connect-agent-w32info.rc
copy to tools/gpg-card-tool-w32info.rc
index 4e7b19d..6937c3e 100644
--- a/tools/gpg-connect-agent-w32info.rc
+++ b/tools/gpg-card-tool-w32info.rc
@@ -1,5 +1,5 @@
-/* scdaemon-w32info.rc                                        -*- c -*-
- * Copyright (C) 2013 g10 Code GmbH
+/* gpg-card-toolt-w32info.rc                                         -*- c -*-
+ * Copyright (C) 2019 g10 Code GmbH
  *
  * This file is free software; as a special exception the author gives
  * unlimited permission to copy and/or distribute it, with or without
@@ -32,10 +32,10 @@
     BEGIN
         BLOCK "040904b0"  /* US English (0409), Unicode (04b0) */
         BEGIN
-            VALUE "FileDescription", L"GnuPG\x2019s command line access \
+            VALUE "FileDescription", L"GnuPG\x2019s card tool \
 to the agent\0"
-            VALUE "InternalName", "gpg-connect-agent\0"
-            VALUE "OriginalFilename", "gpg-connect-agent.exe\0"
+            VALUE "InternalName", "gpg-card-tool\0"
+            VALUE "OriginalFilename", "gpg-card-tool.exe\0"
             VALUE "ProductName",    W32INFO_PRODUCTNAME
             VALUE "ProductVersion", W32INFO_PRODUCTVERSION
             VALUE "CompanyName", W32INFO_COMPANYNAME
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
new file mode 100644
index 0000000..91f0410
--- /dev/null
+++ b/tools/gpg-card-tool.c
@@ -0,0 +1,869 @@
+/* gpg-card-tool.c - An interactive tool to work with cards.
+ * Copyright (C) 2019 g10 Code GmbH Werner Koch
+ *
+ * This file is part of GnuPG.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://gnu.org/licenses/>.
+ * SPDX-License-Identifier: GPL-3.0+
+ */
+
+#include <config.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#ifdef HAVE_LIBREADLINE
+# define GNUPG_LIBREADLINE_H_INCLUDED
+# include <readline/readline.h>
+#endif /*HAVE_LIBREADLINE*/
+
+#include "../common/util.h"
+#include "../common/status.h"
+#include "../common/i18n.h"
+#include "../common/init.h"
+#include "../common/sysutils.h"
+#include "../common/asshelp.h"
+#include "../common/userids.h"
+#include "../common/ccparray.h"
+#include "../common/exectool.h"
+#include "../common/ttyio.h"
+
+#define CONTROL_D ('D' - 'A' + 1)
+
+/* Constants to identify the commands and options. */
+enum cmd_and_opt_values
+  {
+    aNull = 0,
+
+    oQuiet      = 'q',
+    oVerbose	= 'v',
+
+    oDebug      = 500,
+
+    oGpgProgram,
+    oGpgsmProgram,
+    oStatusFD,
+    oWithColons,
+
+    oDummy
+  };
+
+
+/* The list of commands and options. */
+static ARGPARSE_OPTS opts[] = {
+  ARGPARSE_group (300, ("@Commands:\n ")),
+
+  ARGPARSE_group (301, ("@\nOptions:\n ")),
+
+  ARGPARSE_s_n (oVerbose, "verbose", ("verbose")),
+  ARGPARSE_s_n (oQuiet,	"quiet",  ("be somewhat more quiet")),
+  ARGPARSE_s_s (oDebug, "debug", "@"),
+  ARGPARSE_s_s (oGpgProgram, "gpg", "@"),
+  ARGPARSE_s_s (oGpgsmProgram, "gpgsm", "@"),
+  ARGPARSE_s_i (oStatusFD, "status-fd", N_("|FD|write status info to this FD")),
+  ARGPARSE_s_n (oWithColons, "with-colons", "@"),
+
+  ARGPARSE_end ()
+};
+
+/* Debug values and macros.  */
+#define DBG_IPC_VALUE      1024 /* Debug assuan communication.  */
+#define DBG_EXTPROG_VALUE 16384 /* debug external program calls */
+
+
+/* The list of supported debug flags.  */
+static struct debug_flags_s debug_flags [] =
+  {
+    { DBG_IPC_VALUE    , "ipc"     },
+    { DBG_EXTPROG_VALUE, "extprog" },
+    { 0, NULL }
+  };
+
+
+
+/* We keep all global options in the structure OPT.  */
+struct
+{
+  int verbose;
+  unsigned int debug;
+  int quiet;
+  int with_colons;
+  const char *gpg_program;
+  const char *gpgsm_program;
+} opt;
+
+
+static void wrong_args (const char *text) GPGRT_ATTR_NORETURN;
+static void interactive_loop (void);
+#ifdef HAVE_LIBREADLINE
+static char **command_completion (const char *text, int start, int end);
+#endif /*HAVE_LIBREADLINE*/
+
+
+

+/* Print usage information and provide strings for help. */
+static const char *
+my_strusage( int level )
+{
+  const char *p;
+
+  switch (level)
+    {
+    case 11: p = "gpg-card-tool"; break;
+    case 12: p = "@GNUPG@"; break;
+    case 13: p = VERSION; break;
+    case 17: p = PRINTABLE_OS_NAME; break;
+    case 19: p = ("Please report bugs to <@EMAIL@>.\n"); break;
+
+    case 1:
+    case 40:
+      p = ("Usage: gpg-card-tool [command] [options] [args] (-h for help)");
+      break;
+    case 41:
+      p = ("Syntax: gpg-card-tool [command] [options] [args]\n"
+           "Tool to configure cards and tokens\n");
+      break;
+
+    default: p = NULL; break;
+    }
+  return p;
+}
+
+
+static void
+wrong_args (const char *text)
+{
+  es_fprintf (es_stderr, _("usage: %s [options] %s\n"), strusage (11), text);
+  exit (2);
+}
+
+
+

+/* Command line parsing.  */
+static enum cmd_and_opt_values
+parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
+{
+  enum cmd_and_opt_values cmd = 0;
+  int no_more_options = 0;
+
+  while (!no_more_options && optfile_parse (NULL, NULL, NULL, pargs, popts))
+    {
+      switch (pargs->r_opt)
+        {
+	case oQuiet:     opt.quiet = 1; break;
+        case oVerbose:   opt.verbose++; break;
+        case oDebug:
+          if (parse_debug_flag (pargs->r.ret_str, &opt.debug, debug_flags))
+            {
+              pargs->r_opt = ARGPARSE_INVALID_ARG;
+              pargs->err = ARGPARSE_PRINT_ERROR;
+            }
+          break;
+
+        case oGpgProgram:
+          opt.gpg_program = pargs->r.ret_str;
+          break;
+        case oGpgsmProgram:
+          opt.gpgsm_program = pargs->r.ret_str;
+          break;
+        case oStatusFD:
+          gnupg_set_status_fd (translate_sys2libc_fd_int (pargs->r.ret_int, 1));
+          break;
+        case oWithColons:
+          opt.with_colons = 1;
+          break;
+
+        default: pargs->err = 2; break;
+	}
+    }
+
+  return cmd;
+}
+
+
+

+/* gpg-card-tool main. */
+int
+main (int argc, char **argv)
+{
+  gpg_error_t err;
+  ARGPARSE_ARGS pargs;
+  enum cmd_and_opt_values cmd;
+
+  gnupg_reopen_std ("gpg-card-tool");
+  set_strusage (my_strusage);
+  gnupg_rl_initialize ();
+  log_set_prefix ("gpg-card-tool", GPGRT_LOG_WITH_PREFIX);
+
+  /* Make sure that our subsystems are ready.  */
+  i18n_init();
+  init_common_subsystems (&argc, &argv);
+
+  assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
+  setup_libassuan_logging (&opt.debug, NULL);
+
+  /* Parse the command line. */
+  pargs.argc  = &argc;
+  pargs.argv  = &argv;
+  pargs.flags = ARGPARSE_FLAG_KEEP;
+  cmd = parse_arguments (&pargs, opts);
+
+  if (log_get_errorcount (0))
+    exit (2);
+
+  /* Print a warning if an argument looks like an option.  */
+  if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
+    {
+      int i;
+
+      for (i=0; i < argc; i++)
+        if (argv[i][0] == '-' && argv[i][1] == '-')
+          log_info (("NOTE: '%s' is not considered an option\n"), argv[i]);
+    }
+
+  /* Set defaults for non given options.  */
+  if (!opt.gpg_program)
+    opt.gpg_program = gnupg_module_name (GNUPG_MODULE_NAME_GPG);
+  if (!opt.gpgsm_program)
+    opt.gpgsm_program = gnupg_module_name (GNUPG_MODULE_NAME_GPGSM);
+
+  /* Run the selected command.  */
+  switch (cmd)
+    {
+    default:
+      interactive_loop ();
+      err = 0;
+      break;
+    }
+
+  if (err)
+    gnupg_status_printf (STATUS_FAILURE, "- %u", err);
+  else if (log_get_errorcount (0))
+    gnupg_status_printf (STATUS_FAILURE, "- %u", GPG_ERR_GENERAL);
+  else
+    gnupg_status_printf (STATUS_SUCCESS, NULL);
+  return log_get_errorcount (0)? 1:0;
+}
+
+
+
+/* Print all available information about the current card. */
+static void
+print_card_status (char *serialno, size_t serialnobuflen)
+{
+  /* struct agent_card_info_s info; */
+  /* PKT_public_key *pk = xcalloc (1, sizeof *pk); */
+  /* kbnode_t keyblock = NULL; */
+  /* int rc; */
+  /* unsigned int uval; */
+  /* const unsigned char *thefpr; */
+  /* unsigned int thefprlen; */
+  /* int i; */
+
+  /* if (serialno && serialnobuflen) */
+  /*   *serialno = 0; */
+
+  /* rc = agent_scd_learn (&info, 0); */
+  /* if (rc) */
+  /*   { */
+  /*     if (opt.with_colons) */
+  /*       es_fputs ("AID:::\n", fp); */
+  /*     log_error (_("OpenPGP card not available: %s\n"), gpg_strerror (rc)); */
+  /*     xfree (pk); */
+  /*     return; */
+  /*   } */
+
+  /* if (opt.with_colons) */
+  /*   es_fprintf (fp, "Reader:%s:", info.reader? info.reader : ""); */
+  /* else */
+  /*   tty_fprintf (fp, "Reader ...........: %s\n", */
+  /*                info.reader? info.reader : "[none]"); */
+  /* if (opt.with_colons) */
+  /*   es_fprintf (fp, "AID:%s:", info.serialno? info.serialno : ""); */
+  /* else */
+  /*   tty_fprintf (fp, "Application ID ...: %s\n", */
+  /*                info.serialno? info.serialno : "[none]"); */
+  /* if (!info.serialno || strncmp (info.serialno, "D27600012401", 12) */
+  /*     || strlen (info.serialno) != 32 ) */
+  /*   { */
+  /*     if (info.apptype && !strcmp (info.apptype, "NKS")) */
+  /*       { */
+  /*         if (opt.with_colons) */
+  /*           es_fputs ("netkey-card:\n", fp); */
+  /*         log_info ("this is a NetKey card\n"); */
+  /*       } */
+  /*     else if (info.apptype && !strcmp (info.apptype, "DINSIG")) */
+  /*       { */
+  /*         if (opt.with_colons) */
+  /*           es_fputs ("dinsig-card:\n", fp); */
+  /*         log_info ("this is a DINSIG compliant card\n"); */
+  /*       } */
+  /*     else if (info.apptype && !strcmp (info.apptype, "P15")) */
+  /*       { */
+  /*         if (opt.with_colons) */
+  /*           es_fputs ("pkcs15-card:\n", fp); */
+  /*         log_info ("this is a PKCS#15 compliant card\n"); */
+  /*       } */
+  /*     else if (info.apptype && !strcmp (info.apptype, "GELDKARTE")) */
+  /*       { */
+  /*         if (opt.with_colons) */
+  /*           es_fputs ("geldkarte-card:\n", fp); */
+  /*         log_info ("this is a Geldkarte compliant card\n"); */
+  /*       } */
+  /*     else */
+  /*       { */
+  /*         if (opt.with_colons) */
+  /*           es_fputs ("unknown:\n", fp); */
+  /*       } */
+  /*     log_info ("not an OpenPGP card\n"); */
+  /*     agent_release_card_info (&info); */
+  /*     xfree (pk); */
+  /*     return; */
+  /*   } */
+
+  /* if (!serialno) */
+  /*   ; */
+  /* else if (strlen (info.serialno)+1 > serialnobuflen) */
+  /*   log_error ("serial number longer than expected\n"); */
+  /* else */
+  /*   strcpy (serialno, info.serialno); */
+
+  /* if (opt.with_colons) */
+  /*   es_fputs ("openpgp-card:\n", fp); */
+
+
+  /*     tty_fprintf (fp, "Version ..........: %.1s%c.%.1s%c\n", */
+  /*                  info.serialno[12] == '0'?"":info.serialno+12, */
+  /*                  info.serialno[13], */
+  /*                  info.serialno[14] == '0'?"":info.serialno+14, */
+  /*                  info.serialno[15]); */
+  /*     tty_fprintf (fp, "Manufacturer .....: %s\n", */
+  /*                  get_manufacturer (xtoi_2(info.serialno+16)*256 */
+  /*                                    + xtoi_2 (info.serialno+18))); */
+  /*     tty_fprintf (fp, "Serial number ....: %.8s\n", info.serialno+20); */
+
+  /*     print_isoname (fp, "Name of cardholder: ", "name", info.disp_name); */
+  /*     print_name (fp, "Language prefs ...: ", info.disp_lang); */
+  /*     tty_fprintf (fp, "Salutation .......: %s\n", */
+  /*                  info.disp_sex == 1? _("Mr."): */
+  /*                  info.disp_sex == 2? _("Mrs.") : ""); */
+  /*     print_name (fp, "URL of public key : ", info.pubkey_url); */
+  /*     print_name (fp, "Login data .......: ", info.login_data); */
+  /*     if (info.private_do[0]) */
+  /*       print_name (fp, "Private DO 1 .....: ", info.private_do[0]); */
+  /*     if (info.private_do[1]) */
+  /*       print_name (fp, "Private DO 2 .....: ", info.private_do[1]); */
+  /*     if (info.private_do[2]) */
+  /*       print_name (fp, "Private DO 3 .....: ", info.private_do[2]); */
+  /*     if (info.private_do[3]) */
+  /*       print_name (fp, "Private DO 4 .....: ", info.private_do[3]); */
+  /*     if (info.cafpr1len) */
+  /*       { */
+  /*         tty_fprintf (fp, "CA fingerprint %d .:", 1); */
+  /*         print_shax_fpr (fp, info.cafpr1, info.cafpr1len); */
+  /*       } */
+  /*     if (info.cafpr2len) */
+  /*       { */
+  /*         tty_fprintf (fp, "CA fingerprint %d .:", 2); */
+  /*         print_shax_fpr (fp, info.cafpr2, info.cafpr2len); */
+  /*       } */
+  /*     if (info.cafpr3len) */
+  /*       { */
+  /*         tty_fprintf (fp, "CA fingerprint %d .:", 3); */
+  /*         print_shax_fpr (fp, info.cafpr3, info.cafpr3len); */
+  /*       } */
+  /*     tty_fprintf (fp,    "Signature PIN ....: %s\n", */
+  /*                  info.chv1_cached? _("not forced"): _("forced")); */
+  /*     if (info.key_attr[0].algo) */
+  /*       { */
+  /*         tty_fprintf (fp,    "Key attributes ...:"); */
+  /*         for (i=0; i < DIM (info.key_attr); i++) */
+  /*           if (info.key_attr[i].algo == PUBKEY_ALGO_RSA) */
+  /*             tty_fprintf (fp, " rsa%u", info.key_attr[i].nbits); */
+  /*           else if (info.key_attr[i].algo == PUBKEY_ALGO_ECDH */
+  /*                    || info.key_attr[i].algo == PUBKEY_ALGO_ECDSA */
+  /*                    || info.key_attr[i].algo == PUBKEY_ALGO_EDDSA) */
+  /*             { */
+  /*               const char *curve_for_print = "?"; */
+
+  /*               if (info.key_attr[i].curve) */
+  /*                 { */
+  /*                   const char *oid; */
+  /*                   oid = openpgp_curve_to_oid (info.key_attr[i].curve, NULL); */
+  /*                   if (oid) */
+  /*                     curve_for_print = openpgp_oid_to_curve (oid, 0); */
+  /*                 } */
+  /*               tty_fprintf (fp, " %s", curve_for_print); */
+  /*             } */
+  /*         tty_fprintf (fp, "\n"); */
+  /*       } */
+  /*     tty_fprintf (fp,    "Max. PIN lengths .: %d %d %d\n", */
+  /*                  info.chvmaxlen[0], info.chvmaxlen[1], info.chvmaxlen[2]); */
+  /*     tty_fprintf (fp,    "PIN retry counter : %d %d %d\n", */
+  /*                  info.chvretry[0], info.chvretry[1], info.chvretry[2]); */
+  /*     tty_fprintf (fp,    "Signature counter : %lu\n", info.sig_counter); */
+  /*     if (info.extcap.kdf) */
+  /*       { */
+  /*         tty_fprintf (fp, "KDF setting ......: %s\n", */
+  /*                      info.kdf_do_enabled ? "on" : "off"); */
+  /*       } */
+  /*     if (info.extcap.bt) */
+  /*       { */
+  /*         tty_fprintf (fp, "UIF setting ......: Sign=%s Decrypt=%s Auth=%s\n", */
+  /*                      info.uif[0] ? "on" : "off", info.uif[1] ? "on" : "off", */
+  /*                      info.uif[2] ? "on" : "off"); */
+  /*       } */
+  /*     tty_fprintf (fp, "Signature key ....:"); */
+  /*     print_shax_fpr (fp, info.fpr1len? info.fpr1:NULL, info.fpr1len); */
+  /*     if (info.fpr1len && info.fpr1time) */
+  /*       { */
+  /*         tty_fprintf (fp, "      created ....: %s\n", */
+  /*                      isotimestamp (info.fpr1time)); */
+  /*         print_keygrip (fp, info.grp1); */
+  /*       } */
+  /*     tty_fprintf (fp, "Encryption key....:"); */
+  /*     print_shax_fpr (fp, info.fpr2len? info.fpr2:NULL, info.fpr2len); */
+  /*     if (info.fpr2len && info.fpr2time) */
+  /*       { */
+  /*         tty_fprintf (fp, "      created ....: %s\n", */
+  /*                      isotimestamp (info.fpr2time)); */
+  /*         print_keygrip (fp, info.grp2); */
+  /*       } */
+  /*     tty_fprintf (fp, "Authentication key:"); */
+  /*     print_shax_fpr (fp, info.fpr3len? info.fpr3:NULL, info.fpr3len); */
+  /*     if (info.fpr3len && info.fpr3time) */
+  /*       { */
+  /*         tty_fprintf (fp, "      created ....: %s\n", */
+  /*                      isotimestamp (info.fpr3time)); */
+  /*         print_keygrip (fp, info.grp3); */
+  /*       } */
+  /*     tty_fprintf (fp, "General key info..: "); */
+
+  /*     thefpr = (info.fpr1len? info.fpr1 : info.fpr2len? info.fpr2 : */
+  /*               info.fpr3len? info.fpr3 : NULL); */
+  /*     thefprlen = (info.fpr1len? info.fpr1len : info.fpr2len? info.fpr2len : */
+  /*                  info.fpr3len? info.fpr3len : 0); */
+  /*     /\* If the fingerprint is all 0xff, the key has no associated */
+  /*        OpenPGP certificate.  *\/ */
+  /*     if ( thefpr && !fpr_is_ff (thefpr, thefprlen) */
+  /*          && !get_pubkey_byfprint (ctrl, pk, &keyblock, thefpr, thefprlen)) */
+  /*       { */
+  /*         print_pubkey_info (ctrl, fp, pk); */
+  /*         if (keyblock) */
+  /*           print_card_key_info (fp, keyblock); */
+  /*       } */
+  /*     else */
+  /*       tty_fprintf (fp, "[none]\n"); */
+
+  /* release_kbnode (keyblock); */
+  /* free_public_key (pk); */
+  /* agent_release_card_info (&info); */
+}
+
+
+

+static void
+cmd_verify (void)
+{
+  /* agent_scd_checkpin (serialnobuf); */
+}
+
+
+static void
+cmd_name (void)
+{
+  /* change_name (); */
+}
+
+
+static void
+cmd_url (void)
+{
+  /* change_url (); */
+}
+
+
+static void
+cmd_fetch (void)
+{
+  /* fetch_url (); */
+}
+
+
+static void
+cmd_login (char *arg_string)
+{
+  /* change_login (arg_string); */
+}
+
+
+static void
+cmd_lang (void)
+{
+  /* change_lang (); */
+}
+
+
+static void
+cmd_salut (void)
+{
+  /* change_salut (); */
+}
+
+
+static void
+cmd_cafpr (int arg_number)
+{
+  if ( arg_number < 1 || arg_number > 3 )
+    tty_printf ("usage: cafpr N\n"
+                "       1 <= N <= 3\n");
+  /* else */
+  /*   change_cafpr (arg_number); */
+}
+
+
+static void
+cmd_privatedo (int arg_number, char *arg_string)
+{
+  if ( arg_number < 1 || arg_number > 4 )
+    tty_printf ("usage: privatedo N\n"
+                "       1 <= N <= 4\n");
+  /* else */
+  /*   change_private_do (arg_string, arg_number); */
+}
+
+
+static void
+cmd_writecert (int arg_number, char *arg_rest)
+{
+  if ( arg_number != 3 )
+    tty_printf ("usage: writecert 3 < FILE\n");
+  /* else */
+  /*   change_cert (arg_rest); */
+}
+
+
+static void
+cmd_readcert (int arg_number, char *arg_rest)
+{
+  if ( arg_number != 3 )
+    tty_printf ("usage: readcert 3 > FILE\n");
+  /* else */
+  /*   read_cert (arg_rest); */
+}
+
+
+static void
+cmd_forcesig (void)
+{
+  /* toggle_forcesig (); */
+}
+
+
+static void
+cmd_generate (void)
+{
+  /* generate_card_keys (); */
+}
+
+
+static void
+cmd_passwd (int allow_admin)
+{
+  /* change_pin (0, allow_admin); */
+}
+
+
+static void
+cmd_unblock (int allow_admin)
+{
+  /* change_pin (1, allow_admin); */
+}
+
+
+static void
+cmd_factoryreset (void)
+{
+  /* factory_reset (); */
+}
+
+
+static void
+cmd_kdfsetup (char *argstring)
+{
+  /* kdf_setup (arg_string); */
+}
+
+
+static void
+cmd_keyattr (void)
+{
+  /* key_attr (); */
+}
+
+
+static void
+cmd_uif (int arg_number, char *arg_rest)
+{
+  if ( arg_number < 1 || arg_number > 3 )
+    tty_printf ("usage: uif N [on|off|permanent]\n"
+                "       1 <= N <= 3\n");
+  /* else */
+  /*   uif (arg_number, arg_rest); */
+}
+
+
+

+/* Data used by the command parser.  This needs to be outside of the
+ * function scope to allow readline based command completion.  */
+enum cmdids
+  {
+    cmdNOP = 0,
+    cmdQUIT, cmdADMIN, cmdHELP, cmdLIST, cmdDEBUG, cmdVERIFY,
+    cmdNAME, cmdURL, cmdFETCH, cmdLOGIN, cmdLANG, cmdSALUT, cmdCAFPR,
+    cmdFORCESIG, cmdGENERATE, cmdPASSWD, cmdPRIVATEDO, cmdWRITECERT,
+    cmdREADCERT, cmdUNBLOCK, cmdFACTORYRESET, cmdKDFSETUP,
+    cmdKEYATTR, cmdUIF,
+    cmdINVCMD
+  };
+
+static struct
+{
+  const char *name;
+  enum cmdids id;
+  int admin_only;
+  const char *desc;
+} cmds[] = {
+  { "quit"    , cmdQUIT  , 0, N_("quit this menu")},
+  { "q"       , cmdQUIT  , 0, NULL },
+  { "admin"   , cmdADMIN , 0, N_("show admin commands")},
+  { "help"    , cmdHELP  , 0, N_("show this help")},
+  { "?"       , cmdHELP  , 0, NULL },
+  { "list"    , cmdLIST  , 0, N_("list all available data")},
+  { "l"       , cmdLIST  , 0, NULL },
+  { "debug"   , cmdDEBUG , 0, NULL },
+  { "name"    , cmdNAME  , 1, N_("change card holder's name")},
+  { "url"     , cmdURL   , 1, N_("change URL to retrieve key")},
+  { "fetch"   , cmdFETCH , 0, N_("fetch the key specified in the card URL")},
+  { "login"   , cmdLOGIN , 1, N_("change the login name")},
+  { "lang"    , cmdLANG  , 1, N_("change the language preferences")},
+  { "salutation",cmdSALUT, 1, N_("change card holder's salutation")},
+  { "cafpr"   , cmdCAFPR , 1, N_("change a CA fingerprint")},
+  { "forcesig", cmdFORCESIG, 1, N_("toggle the signature force PIN flag")},
+  { "generate", cmdGENERATE, 1, N_("generate new keys")},
+  { "passwd"  , cmdPASSWD, 0, N_("menu to change or unblock the PIN")},
+  { "verify"  , cmdVERIFY, 0, N_("verify the PIN and list all data")},
+  { "unblock" , cmdUNBLOCK,0, N_("unblock the PIN using a Reset Code")},
+  { "factory-reset", cmdFACTORYRESET, 1, N_("destroy all keys and data")},
+  { "kdf-setup", cmdKDFSETUP, 1, N_("setup KDF for PIN authentication")},
+  { "key-attr", cmdKEYATTR, 1, N_("change the key attribute")},
+  { "uif", cmdUIF, 1, N_("change the User Interaction Flag")},
+  /* Note, that we do not announce these command yet. */
+  { "privatedo", cmdPRIVATEDO, 0, NULL },
+  { "readcert", cmdREADCERT, 0, NULL },
+  { "writecert", cmdWRITECERT, 1, NULL },
+  { NULL, cmdINVCMD, 0, NULL }
+};
+
+
+/* The main loop.  */
+static void
+interactive_loop (void)
+{
+  char *answer = NULL;         /* The input line.  */
+  enum cmdids cmd = cmdNOP;    /* The command.  */
+  int cmd_admin_only;          /* The command is an admin only command.  */
+  int arg_number;              /* The first argument as a number.  */
+  char *arg_string = "";       /* The first argument as a string.  */
+  char *arg_rest = "";         /* The remaining arguments.  */
+  int redisplay = 1;           /* Whether to redisplay the main info.  */
+  int allow_admin = 0;         /* Whether admin commands are allowed.  */
+  char serialnobuf[50];
+  char *p;
+  int i;
+
+  for (;;)
+    {
+
+      tty_printf ("\n");
+      if (redisplay)
+        {
+          print_card_status (serialnobuf, DIM (serialnobuf));
+          tty_printf("\n");
+          redisplay = 0;
+	}
+
+      do
+        {
+          xfree (answer);
+          tty_enable_completion (command_completion);
+          answer = tty_get (_("gpg/card> "));
+          tty_kill_prompt();
+          tty_disable_completion ();
+          trim_spaces(answer);
+	}
+      while ( *answer == '#' );
+
+      arg_number = 0;
+      cmd_admin_only = 0;
+      if (!*answer)
+        cmd = cmdLIST; /* We default to the list command */
+      else if (*answer == CONTROL_D)
+        cmd = cmdQUIT;
+      else
+        {
+          if ((p=strchr (answer,' ')))
+            {
+              *p++ = 0;
+              trim_spaces (answer);
+              trim_spaces (p);
+              arg_number = atoi (p);
+              arg_string = p;
+              arg_rest = p;
+              while (digitp (arg_rest))
+                arg_rest++;
+              while (spacep (arg_rest))
+                arg_rest++;
+            }
+
+          for (i=0; cmds[i].name; i++ )
+            if (!ascii_strcasecmp (answer, cmds[i].name ))
+              break;
+
+          cmd = cmds[i].id;
+          cmd_admin_only = cmds[i].admin_only;
+        }
+
+      if (!allow_admin && cmd_admin_only)
+	{
+          tty_printf ("\n");
+          tty_printf (_("Admin-only command\n"));
+          continue;
+        }
+
+      switch (cmd)
+        {
+        case cmdNOP:
+          break;
+
+        case cmdQUIT:
+          goto leave;
+
+        case cmdHELP:
+          for (i=0; cmds[i].name; i++ )
+            if(cmds[i].desc
+	       && (!cmds[i].admin_only || (cmds[i].admin_only && allow_admin)))
+              tty_printf("%-14s %s\n", cmds[i].name, _(cmds[i].desc) );
+          break;
+
+	case cmdADMIN:
+          if ( !strcmp (arg_string, "on") )
+            allow_admin = 1;
+          else if ( !strcmp (arg_string, "off") )
+            allow_admin = 0;
+          else if ( !strcmp (arg_string, "verify") )
+            {
+              /* Force verification of the Admin Command.  However,
+                 this is only done if the retry counter is at initial
+                 state.  */
+              /* FIXME: Must depend on the type of the card.  */
+              /* char *tmp = xmalloc (strlen (serialnobuf) + 6 + 1); */
+              /* strcpy (stpcpy (tmp, serialnobuf), "[CHV3]"); */
+              /* allow_admin = !agent_scd_checkpin (tmp); */
+              /* xfree (tmp); */
+            }
+          else /* Toggle. */
+            allow_admin=!allow_admin;
+	  if(allow_admin)
+	    tty_printf(_("Admin commands are allowed\n"));
+	  else
+	    tty_printf(_("Admin commands are not allowed\n"));
+	  break;
+
+        case cmdVERIFY:    cmd_verify (); redisplay = 1; break;
+        case cmdLIST:                     redisplay = 1; break;
+        case cmdNAME:      cmd_name ();   break;
+        case cmdURL:       cmd_url ();    break;
+	case cmdFETCH:     cmd_fetch ();  break;
+        case cmdLOGIN:     cmd_login (arg_string); break;
+        case cmdLANG:      cmd_lang ();   break;
+        case cmdSALUT:     cmd_salut ();  break;
+        case cmdCAFPR:     cmd_cafpr (arg_number); break;
+        case cmdPRIVATEDO: cmd_privatedo (arg_number, arg_string); break;
+        case cmdWRITECERT: cmd_writecert (arg_number, arg_rest); break;
+        case cmdREADCERT:  cmd_readcert (arg_number, arg_rest); break;
+        case cmdFORCESIG:  cmd_forcesig (); break;
+        case cmdGENERATE:  cmd_generate (); break;
+        case cmdPASSWD:    cmd_passwd (allow_admin); break;
+        case cmdUNBLOCK:   cmd_unblock (allow_admin); break;
+        case cmdFACTORYRESET: cmd_factoryreset (); break;
+        case cmdKDFSETUP:  cmd_kdfsetup (arg_string); break;
+        case cmdKEYATTR:   cmd_keyattr (); break;
+        case cmdUIF:       cmd_uif (arg_number, arg_rest); break;
+
+        case cmdINVCMD:
+        default:
+          tty_printf ("\n");
+          tty_printf (_("Invalid command  (try \"help\")\n"));
+          break;
+        } /* End command switch. */
+    } /* End of main menu loop. */
+
+ leave:
+  xfree (answer);
+}
+
+#ifdef HAVE_LIBREADLINE
+/* Helper function for readline's command completion. */
+static char *
+command_generator (const char *text, int state)
+{
+  static int list_index, len;
+  const char *name;
+
+  /* If this is a new word to complete, initialize now.  This includes
+   * saving the length of TEXT for efficiency, and initializing the
+   index variable to 0. */
+  if (!state)
+    {
+      list_index = 0;
+      len = strlen(text);
+    }
+
+  /* Return the next partial match */
+  while ((name = cmds[list_index].name))
+    {
+      /* Only complete commands that have help text. */
+      if (cmds[list_index++].desc && !strncmp (name, text, len))
+	return strdup(name);
+    }
+
+  return NULL;
+}
+
+/* Second helper function for readline's command completion.  */
+static char **
+command_completion (const char *text, int start, int end)
+{
+  (void)end;
+
+  /* If we are at the start of a line, we try and command-complete.
+   * If not, just do nothing for now. */
+  if (!start)
+    return rl_completion_matches (text, command_generator);
+
+  rl_attempted_completion_over = 1;
+
+  return NULL;
+}
+#endif /*HAVE_LIBREADLINE*/
diff --git a/tools/gpg-connect-agent-w32info.rc b/tools/gpg-connect-agent-w32info.rc
index 4e7b19d..8c67359 100644
--- a/tools/gpg-connect-agent-w32info.rc
+++ b/tools/gpg-connect-agent-w32info.rc
@@ -1,4 +1,4 @@
-/* scdaemon-w32info.rc                                        -*- c -*-
+/* gpg-connect-agent-w32info.rc                               -*- c -*-
  * Copyright (C) 2013 g10 Code GmbH
  *
  * This file is free software; as a special exception the author gives

commit 03cf23b43ec5fea8a355d3ba2200e86a8efc589b
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 22 09:02:17 2019 +0100

    common: Add generic status print function.
    
    * common/status.c (gnupg_set_status_fd): New.
    (gnupg_status_printf): New.
    * po/Makevars (XGETTEXT_OPTIONS): Add gnupg-status_printf.
    --
    
    Some of the extra tools take a --status-fd option to print certain
    status messages.  A generic printf style print function thus makes
    sense.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/status.c b/common/status.c
index 50afce4..269ffea 100644
--- a/common/status.c
+++ b/common/status.c
@@ -34,6 +34,10 @@
 #include "status.h"
 #include "status-codes.h"
 
+/* The stream to output the status information.  Output is disabled if
+ * this is NULL.  */
+static estream_t statusfp;
+
 
 /* Return the status string for code NO. */
 const char *
@@ -47,6 +51,60 @@ get_status_string ( int no )
 }
 
 
+/* Set a global status FD.  */
+void
+gnupg_set_status_fd (int fd)
+{
+  static int last_fd = -1;
+
+  if (fd != -1 && last_fd == fd)
+    return;
+
+  if (statusfp && statusfp != es_stdout && statusfp != es_stderr)
+    es_fclose (statusfp);
+  statusfp = NULL;
+  if (fd == -1)
+    return;
+
+  if (fd == 1)
+    statusfp = es_stdout;
+  else if (fd == 2)
+    statusfp = es_stderr;
+  else
+    statusfp = es_fdopen (fd, "w");
+  if (!statusfp)
+    {
+      log_fatal ("can't open fd %d for status output: %s\n",
+                 fd, gpg_strerror (gpg_error_from_syserror ()));
+    }
+  last_fd = fd;
+}
+
+
+/* Write a status line with code NO followed by the output of the
+ * printf style FORMAT.  The caller needs to make sure that LFs and
+ * CRs are not printed.  */
+void
+gnupg_status_printf (int no, const char *format, ...)
+{
+  va_list arg_ptr;
+
+  if (!statusfp)
+    return;  /* Not enabled.  */
+
+  es_fputs ("[GNUPG:] ", statusfp);
+  es_fputs (get_status_string (no), statusfp);
+  if (format)
+    {
+      es_putc (' ', statusfp);
+      va_start (arg_ptr, format);
+      es_vfprintf (statusfp, format, arg_ptr);
+      va_end (arg_ptr);
+    }
+  es_putc ('\n', statusfp);
+}
+
+
 const char *
 get_inv_recpsgnr_code (gpg_error_t err)
 {
diff --git a/common/status.h b/common/status.h
index dc62f36..aeab542 100644
--- a/common/status.h
+++ b/common/status.h
@@ -163,6 +163,10 @@ enum
 
 
 const char *get_status_string (int code);
+void gnupg_set_status_fd (int fd);
+void gnupg_status_printf (int no, const char *format,
+                          ...) GPGRT_ATTR_PRINTF(2,3);
+
 const char *get_inv_recpsgnr_code (gpg_error_t err);
 
 
diff --git a/po/Makevars b/po/Makevars
index 20d6ae9..07778e0 100644
--- a/po/Makevars
+++ b/po/Makevars
@@ -61,6 +61,7 @@ XGETTEXT_OPTIONS = \
 	--flag=ks_printf_help:2:c-format         \
 	--flag=print_further_info:1:c-format     \
 	--flag=write_status_printf:2:c-format    \
+	--flag=gnupg_printf_status:2:c-format    \
 	--flag=kbxd_print_status:3:c-format      \
 	--flag=gpgconf_write_status:2:c-format   \
         --flag=send_status_printf:3:c-format     \

-----------------------------------------------------------------------

Summary of changes:
 common/status.c                                    |  58 ++
 common/status.h                                    |   4 +
 g10/misc.c                                         |   7 +
 po/Makevars                                        |   1 +
 tools/Makefile.am                                  |  20 +-
 ...t-agent-w32info.rc => gpg-card-tool-w32info.rc} |  10 +-
 tools/gpg-card-tool.c                              | 869 +++++++++++++++++++++
 tools/gpg-connect-agent-w32info.rc                 |   2 +-
 8 files changed, 960 insertions(+), 11 deletions(-)
 copy tools/{gpg-connect-agent-w32info.rc => gpg-card-tool-w32info.rc} (83%)
 create mode 100644 tools/gpg-card-tool.c


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 22 10:18:14 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 22 Jan 2019 10:18:14 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.2.12-13-g9fd6ba2
Message-ID: <E1glsCF-0003wA-42@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  9fd6ba268f1fdf77cc5baa6e8fd3ab28e432e49b (commit)
       via  d4082ff430afe670510d2c1c7ea66ee9ddcbe505 (commit)
       via  9309175de8c76de44021c25c7885355ff1a9b67b (commit)
       via  11a65159f997ccd69ecb9d867c1f3d0c4d8837d6 (commit)
       via  f5d3b982e44c5cfc60e9936020102a598b635187 (commit)
      from  9dc76d599cd4c86d3c187d078daad1144a92564c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9fd6ba268f1fdf77cc5baa6e8fd3ab28e432e49b
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 8 11:21:07 2019 +0100

    doc: Mark keyserver-options timeout and http-proxy as obsolete.
    
    --
    
    (cherry picked from commit 6c000d4b78b836686e5a2789cc88a41e465e4400)

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 1eed9fa..1597f9e 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1895,32 +1895,12 @@ are available for all keyserver types, some common options are:
   retrieving keys by subkey id.
 
   @item timeout
-  Tell the keyserver helper program how long (in seconds) to try and
-  perform a keyserver action before giving up. Note that performing
-  multiple actions at the same time uses this timeout value per action.
-  For example, when retrieving multiple keys via @option{--receive-keys}, the
-  timeout applies separately to each key retrieval, and not to the
-  @option{--receive-keys} command as a whole. Defaults to 30 seconds.
-
-  @item http-proxy=@var{value}
-  This option is deprecated.
-  Set the proxy to use for HTTP and HKP keyservers.
-  This overrides any proxy defined in @file{dirmngr.conf}.
-
-  @item verbose
-  This option has no more function since GnuPG 2.1.  Use the
-  @code{dirmngr} configuration options instead.
-
-  @item debug
-  This option has no more function since GnuPG 2.1.  Use the
-  @code{dirmngr} configuration options instead.
-
-  @item check-cert
-  This option has no more function since GnuPG 2.1.  Use the
-  @code{dirmngr} configuration options instead.
-
+  @itemx http-proxy=@var{value}
+  @itemx verbose
+  @itemx debug
+  @itemx check-cert
   @item ca-cert-file
-  This option has no more function since GnuPG 2.1.  Use the
+  These options have no more function since GnuPG 2.1.  Use the
   @code{dirmngr} configuration options instead.
 
 @end table

commit d4082ff430afe670510d2c1c7ea66ee9ddcbe505
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 21 14:06:51 2019 +0100

    scd: Add option --clear to PASSWD.
    
    * scd/command.c (cmd_passwd): Add option --clear.
    (send_status_printf): New.
    * scd/app-common.h (APP_CHANGE_FLAG_CLEAR): New.
    * scd/app-nks.c (do_change_pin): Return an error if that option is
    used.
    * scd/app-openpgp.c (do_change_pin): Ditto.
    --
    
    Card application may support this option to clear the PIN verification
    status of a specific PIN.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit 29929e65521279eabc98a67c766fe485057405a9)

diff --git a/po/Makevars b/po/Makevars
index b538f19..270ac59 100644
--- a/po/Makevars
+++ b/po/Makevars
@@ -62,6 +62,7 @@ XGETTEXT_OPTIONS = \
 	--flag=print_further_info:1:c-format     \
 	--flag=write_status_printf:2:c-format    \
 	--flag=gpgconf_write_status:2:c-format   \
+        --flag=send_status_printf:3:c-format     \
 	--flag=wks_write_status:2:c-format
 
 # This is the copyright holder that gets inserted into the header of the
diff --git a/scd/app-common.h b/scd/app-common.h
index 38e6cc6..37e3c60 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -26,8 +26,9 @@
 #include <ksba.h>
 
 
-#define APP_CHANGE_FLAG_RESET    1
-#define APP_CHANGE_FLAG_NULLPIN  2
+#define APP_CHANGE_FLAG_RESET    1  /* PIN Reset mode.  */
+#define APP_CHANGE_FLAG_NULLPIN  2  /* NULL PIN mode.  */
+#define APP_CHANGE_FLAG_CLEAR    4  /* Clear the given PIN.  */
 
 /* Bit flags set by the decipher function into R_INFO.  */
 #define APP_DECIPHER_INFO_NOPAD  1  /* Padding has been removed.  */
diff --git a/scd/app-nks.c b/scd/app-nks.c
index 801ab90..0f38e7c 100644
--- a/scd/app-nks.c
+++ b/scd/app-nks.c
@@ -1169,6 +1169,9 @@ do_change_pin (app_t app, ctrl_t ctrl,  const char *pwidstr,
   if (!newdesc)
     return gpg_error (GPG_ERR_INV_ID);
 
+  if ((flags & APP_CHANGE_FLAG_CLEAR))
+    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+
   err = switch_application (app, is_sigg);
   if (err)
     return err;
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index fa23fbe..760332e 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -2584,10 +2584,14 @@ do_change_pin (app_t app, ctrl_t ctrl,  const char *chvnostr,
   int pinlen = 0;
 
   (void)ctrl;
+
   memset (&pininfo, 0, sizeof pininfo);
   pininfo.fixedlen = -1;
   pininfo.minlen = minlen;
 
+  if ((flags & APP_CHANGE_FLAG_CLEAR))
+    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+
   if (reset_mode && chvno == 3)
     {
       rc = gpg_error (GPG_ERR_INV_ID);
diff --git a/scd/app.c b/scd/app.c
index a82db26..c430579 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -938,7 +938,7 @@ app_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr, int reset_mode,
 }
 
 
-/* Perform a VERIFY operation without doing anything lese.  This may
+/* Perform a VERIFY operation without doing anything else.  This may
    be used to initialize a the PIN cache for long lasting other
    operations.  Its use is highly application dependent. */
 gpg_error_t
diff --git a/scd/command.c b/scd/command.c
index 8fa4b38..ec6793a 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -1192,12 +1192,13 @@ cmd_random (assuan_context_t ctx, char *line)
 
 

 static const char hlp_passwd[] =
-  "PASSWD [--reset] [--nullpin] <chvno>\n"
+  "PASSWD [--reset] [--nullpin] [--clear] <chvno>\n"
   "\n"
   "Change the PIN or, if --reset is given, reset the retry counter of\n"
   "the card holder verification vector CHVNO.  The option --nullpin is\n"
-  "used for TCOS cards to set the initial PIN.  The format of CHVNO\n"
-  "depends on the card application.";
+  "used for TCOS cards to set the initial PIN.  The option --clear clears\n"
+  "the security status associated with the PIN so that the PIN needs to\n"
+  "be presented again. The format of CHVNO depends on the card application.";
 static gpg_error_t
 cmd_passwd (assuan_context_t ctx, char *line)
 {
@@ -1210,6 +1211,8 @@ cmd_passwd (assuan_context_t ctx, char *line)
     flags |= APP_CHANGE_FLAG_RESET;
   if (has_option (line, "--nullpin"))
     flags |= APP_CHANGE_FLAG_NULLPIN;
+  if (has_option (line, "--clear"))
+    flags |= APP_CHANGE_FLAG_CLEAR;
 
   line = skip_options (line);
 
@@ -1220,6 +1223,11 @@ cmd_passwd (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
+  /* Do not allow other flags aside of --clear. */
+  if ((flags & APP_CHANGE_FLAG_CLEAR) && (flags & ~APP_CHANGE_FLAG_CLEAR))
+    return set_error (GPG_ERR_UNSUPPORTED_OPERATION,
+                      "--clear used with other options");
+
   if ((rc = open_card (ctrl)))
     return rc;
 
@@ -1899,6 +1907,26 @@ send_status_direct (ctrl_t ctrl, const char *keyword, const char *args)
 }
 
 
+/* This status functions expects a printf style format string.  No
+ * filtering of the data is done instead the orintf formatted data is
+ * send using assuan_send_status. */
+gpg_error_t
+send_status_printf (ctrl_t ctrl, const char *keyword, const char *format, ...)
+{
+  gpg_error_t err;
+  va_list arg_ptr;
+  assuan_context_t ctx;
+
+  if (!ctrl || !ctrl->server_local || !(ctx = ctrl->server_local->assuan_ctx))
+    return 0;
+
+  va_start (arg_ptr, format);
+  err = vprint_assuan_status (ctx, keyword, format, arg_ptr);
+  va_end (arg_ptr);
+  return err;
+}
+
+
 void
 popup_prompt (void *opaque, int on)
 {
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 238e6a8..73589ad 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -123,6 +123,9 @@ int  scd_command_handler (ctrl_t, int);
 void send_status_info (ctrl_t ctrl, const char *keyword, ...)
      GPGRT_ATTR_SENTINEL(1);
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
+gpg_error_t send_status_printf (ctrl_t ctrl, const char *keyword,
+                                const char *format, ...) GPGRT_ATTR_PRINTF(3,4);
+
 void popup_prompt (void *opaque, int on);
 void send_client_notifications (app_t app, int removal);
 void scd_kick_the_loop (void);

commit 9309175de8c76de44021c25c7885355ff1a9b67b
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 20 11:41:23 2019 +0100

    scd: One new and one improved 7816 function.
    
    * scd/apdu.c (apdu_send_direct): New arg R_SW.
    * scd/command.c (cmd_apdu): Ditto.
    * scd/iso7816.c (iso7816_apdu_direct): New arg R_SW.
    (iso7816_general_authenticate): New.
    * scd/app-nks.c (get_chv_status, get_nks_version): Pass NULL for new
    arg.
    --
    
    iso7816_general_authenticate will be used for the PIV card support.
    The new arg to iso7816_apdu_direct and apdu_send_direct allows to get
    the raw status word back without the need to handle an output buffer.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit 70bb5c7931598590b1acfae90bf4657f5911d2d3)

diff --git a/scd/apdu.c b/scd/apdu.c
index 7ed0b97..af77570 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -3062,19 +3062,25 @@ apdu_send_simple (int slot, int extended_mode,
 
 
 /* This is a more generic version of the apdu sending routine.  It
-   takes an already formatted APDU in APDUDATA or length APDUDATALEN
-   and returns with an APDU including the status word.  With
-   HANDLE_MORE set to true this function will handle the MORE DATA
-   status and return all APDUs concatenated with one status word at
-   the end.  If EXTENDED_LENGTH is != 0 extended lengths are allowed
-   with a max. result data length of EXTENDED_LENGTH bytes.  The
-   function does not return a regular status word but 0 on success.
-   If the slot is locked, the function returns immediately with an
-   error.  */
+ * takes an already formatted APDU in APDUDATA or length APDUDATALEN
+ * and returns with an APDU including the status word.  With
+ * HANDLE_MORE set to true this function will handle the MORE DATA
+ * status and return all APDUs concatenated with one status word at
+ * the end.  If EXTENDED_LENGTH is != 0 extended lengths are allowed
+ * with a max. result data length of EXTENDED_LENGTH bytes.  The
+ * function does not return a regular status word but 0 on success.
+ * If the slot is locked, the function returns immediately with an
+ * error.
+ *
+ * Out of historical reasons the function returns 0 on success and
+ * outs the status word at the end of the result to be able to get the
+ * status word in the case of a not provided RETBUF, R_SW can be used
+ * to store the SW.  But note that R_SW qill only be set if the
+ * function returns 0. */
 int
 apdu_send_direct (int slot, size_t extended_length,
                   const unsigned char *apdudata, size_t apdudatalen,
-                  int handle_more,
+                  int handle_more, unsigned int *r_sw,
                   unsigned char **retbuf, size_t *retbuflen)
 {
 #define SHORT_RESULT_BUFFER_SIZE 258
@@ -3281,9 +3287,13 @@ apdu_send_direct (int slot, size_t extended_length,
       (*retbuf)[(*retbuflen)++] = sw;
     }
 
+  if (r_sw)
+    *r_sw = sw;
+
   if (DBG_CARD_IO && retbuf)
     log_printhex ("      dump: ", *retbuf, *retbuflen);
 
+
   return 0;
 }
 
diff --git a/scd/apdu.h b/scd/apdu.h
index f7bc0bc..6240134 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -137,7 +137,7 @@ int apdu_send_le (int slot, int extended_mode,
                   unsigned char **retbuf, size_t *retbuflen);
 int apdu_send_direct (int slot, size_t extended_length,
                       const unsigned char *apdudata, size_t apdudatalen,
-                      int handle_more,
+                      int handle_more, unsigned int *r_sw,
                       unsigned char **retbuf, size_t *retbuflen);
 const char *apdu_get_reader_name (int slot);
 
diff --git a/scd/app-nks.c b/scd/app-nks.c
index 9e720f0..801ab90 100644
--- a/scd/app-nks.c
+++ b/scd/app-nks.c
@@ -273,7 +273,7 @@ get_chv_status (app_t app, int sigg, int pwid)
   command[3] = pwid;
 
   if (apdu_send_direct (app->slot, 0, (unsigned char *)command,
-                        4, 0, &result, &resultlen))
+                        4, 0, NULL, &result, &resultlen))
     rc = -1; /* Error. */
   else if (resultlen < 2)
     rc = -1; /* Error. */
@@ -1300,7 +1300,7 @@ get_nks_version (int slot)
   int type;
 
   if (iso7816_apdu_direct (slot, "\x80\xaa\x06\x00\x00", 5, 0,
-                           &result, &resultlen))
+                           NULL, &result, &resultlen))
     return 2; /* NKS 2 does not support this command.  */
 
   /* Example value:    04 11 19 22 21 6A 20 80 03 03 01 01 01 00 00 00
diff --git a/scd/command.c b/scd/command.c
index 0a96546..8fa4b38 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -333,7 +333,7 @@ static const char hlp_learn[] =
   "or a \"CANCEL\" to force the function to terminate with a Cancel\n"
   "error message.\n"
   "\n"
-  "With the option --keypairinfo only KEYPARIINFO lstatus lines are\n"
+  "With the option --keypairinfo only KEYPARIINFO status lines are\n"
   "returned.\n"
   "\n"
   "The response of this command is a list of status lines formatted as\n"
@@ -346,6 +346,7 @@ static const char hlp_learn[] =
   "    P15     = PKCS-15 structure used\n"
   "    DINSIG  = DIN SIG\n"
   "    OPENPGP = OpenPGP card\n"
+  "    PIV     = PIV card\n"
   "    NKS     = NetKey card\n"
   "\n"
   "are implemented.  These strings are aliases for the AID\n"
@@ -1640,7 +1641,7 @@ cmd_apdu (assuan_context_t ctx, char *line)
 
       rc = apdu_send_direct (app->slot, exlen,
                              apdu, apdulen, handle_more,
-                             &result, &resultlen);
+                             NULL, &result, &resultlen);
       if (rc)
         log_error ("apdu_send_direct failed: %s\n", gpg_strerror (rc));
       else
diff --git a/scd/iso7816.c b/scd/iso7816.c
index 081b080..9e55073 100644
--- a/scd/iso7816.c
+++ b/scd/iso7816.c
@@ -50,6 +50,7 @@
 #define CMD_PUT_DATA    0xDA
 #define CMD_MSE         0x22
 #define CMD_PSO         0x2A
+#define CMD_GENERAL_AUTHENTICATE  0x87
 #define CMD_INTERNAL_AUTHENTICATE 0x88
 #define CMD_GENERATE_KEYPAIR      0x47
 #define CMD_GET_CHALLENGE         0x84
@@ -209,24 +210,28 @@ iso7816_list_directory (int slot, int list_dirs,
    internally.  The return value is a gpg error code (i.e. a mapped
    status word).  This is basically the same as apdu_send_direct but
    it maps the status word and does not return it in the result
-   buffer.  */
+   buffer.  However, it R_SW is not NULL the status word is stored
+   R_SW for closer inspection. */
 gpg_error_t
 iso7816_apdu_direct (int slot, const void *apdudata, size_t apdudatalen,
-                     int handle_more,
+                     int handle_more, unsigned int *r_sw,
                      unsigned char **result, size_t *resultlen)
 {
-  int sw;
+  int sw, sw2;
 
-  if (!result || !resultlen)
-    return gpg_error (GPG_ERR_INV_VALUE);
-  *result = NULL;
-  *resultlen = 0;
+  if (result)
+    {
+      *result = NULL;
+      *resultlen = 0;
+    }
 
   sw = apdu_send_direct (slot, 0, apdudata, apdudatalen, handle_more,
-                         result, resultlen);
+                         &sw2, result, resultlen);
   if (!sw)
     {
-      if (*resultlen < 2)
+      if (!result)
+        sw = sw2;
+      else if (*resultlen < 2)
         sw = SW_HOST_GENERAL_ERROR;
       else
         {
@@ -235,13 +240,15 @@ iso7816_apdu_direct (int slot, const void *apdudata, size_t apdudatalen,
           (*resultlen)--;
         }
     }
-  if (sw != SW_SUCCESS)
+  if (sw != SW_SUCCESS && result)
     {
       /* Make sure that pending buffers are released. */
       xfree (*result);
       *result = NULL;
       *resultlen = 0;
     }
+  if (r_sw)
+    *r_sw = sw;
   return map_sw (sw);
 }
 
@@ -541,7 +548,7 @@ iso7816_decipher (int slot, int extended_mode,
 }
 
 
-/*  For LE see do_generate_keypair.  */
+/* For LE see do_generate_keypair.  */
 gpg_error_t
 iso7816_internal_authenticate (int slot, int extended_mode,
                                const unsigned char *data, size_t datalen,
@@ -578,6 +585,44 @@ iso7816_internal_authenticate (int slot, int extended_mode,
 }
 
 
+/* For LE see do_generate_keypair.  */
+gpg_error_t
+iso7816_general_authenticate (int slot, int extended_mode,
+                              int algoref, int keyref,
+                              const unsigned char *data, size_t datalen,
+                              int le,
+                              unsigned char **result, size_t *resultlen)
+{
+  int sw;
+
+  if (!data || !datalen || !result || !resultlen)
+    return gpg_error (GPG_ERR_INV_VALUE);
+  *result = NULL;
+  *resultlen = 0;
+
+  if (!extended_mode)
+    le = 256;  /* Ignore provided Le and use what apdu_send uses. */
+  else if (le >= 0 && le < 256)
+    le = 256;
+
+  sw = apdu_send_le (slot, extended_mode,
+                     0x00, CMD_GENERAL_AUTHENTICATE, algoref, keyref,
+                     datalen, (const char*)data,
+                     le,
+                     result, resultlen);
+  if (sw != SW_SUCCESS)
+    {
+      /* Make sure that pending buffers are released. */
+      xfree (*result);
+      *result = NULL;
+      *resultlen = 0;
+      return map_sw (sw);
+    }
+
+  return 0;
+}
+
+
 /* LE is the expected return length.  This is usually 0 except if
    extended length mode is used and more than 256 byte will be
    returned.  In that case a value of -1 uses a large default
diff --git a/scd/iso7816.h b/scd/iso7816.h
index 4c71bbd..44781ff 100644
--- a/scd/iso7816.h
+++ b/scd/iso7816.h
@@ -58,7 +58,7 @@ gpg_error_t iso7816_list_directory (int slot, int list_dirs,
                                     unsigned char **result, size_t *resultlen);
 gpg_error_t iso7816_apdu_direct (int slot,
                                  const void *apdudata, size_t apdudatalen,
-                                 int handle_more,
+                                 int handle_more, unsigned int *r_sw,
                                  unsigned char **result, size_t *resultlen);
 gpg_error_t iso7816_check_pinpad (int slot, int command,
                                   pininfo_t *pininfo);
@@ -97,6 +97,13 @@ gpg_error_t iso7816_internal_authenticate (int slot, int extended_mode,
                                    const unsigned char *data, size_t datalen,
                                    int le,
                                    unsigned char **result, size_t *resultlen);
+gpg_error_t iso7816_general_authenticate (int slot, int extended_mode,
+                                          int algoref, int keyref,
+                                          const unsigned char *data,
+                                          size_t datalen,
+                                          int le,
+                                          unsigned char **result,
+                                          size_t *resultlen);
 gpg_error_t iso7816_generate_keypair (int slot, int extended_mode,
                                     const char *data, size_t datalen,
                                     int le,

commit 11a65159f997ccd69ecb9d867c1f3d0c4d8837d6
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 17 15:42:33 2019 +0100

    ssh: Simplify the curve name lookup.
    
    * agent/command-ssh.c (struct ssh_key_type_spec): Add field
    alt_curve_name.
    (ssh_key_types): Add some alternate curve names.
    (ssh_identifier_from_curve_name): Lookup also bey alternative names
    and return the canonical name.
    (ssh_key_to_blob): Simplify the ECDSA case by using gcry_pk_get_curve
    instead of the explicit mapping.
    (ssh_receive_key): Likewise.  Use ssh_identifier_from_curve_name to
    validate the curve name.  Remove the reverse mapping because since
    GnuPG-2.2 Libgcrypt 1.7 is required.
    (ssh_handler_request_identities): Log an error message.
    --
    
    This change will make it easier to support other curves, in particular
    those from tokens.  Libgcrypt has a large list of alias names which we
    now use to to make the mapping more flexible.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit d93797c8a7892fe26672c551017468e9f8099ef6)

diff --git a/agent/command-ssh.c b/agent/command-ssh.c
index 9255830..3cfd8aa 100644
--- a/agent/command-ssh.c
+++ b/agent/command-ssh.c
@@ -195,9 +195,14 @@ struct ssh_key_type_spec
      algorithm.  */
   ssh_signature_encoder_t signature_encoder;
 
-  /* The name of the ECC curve or NULL.  */
+  /* The name of the ECC curve or NULL for non-ECC algos.  This is the
+   * canonical name for the curve as specified by RFC-5656.  */
   const char *curve_name;
 
+  /* An alias for curve_name or NULL.  Actually this is Libcgrypt's
+   * primary name of the curve.  */
+  const char *alt_curve_name;
+
   /* The hash algorithm to be used with this key.  0 for using the
      default.  */
   int hash_algo;
@@ -292,68 +297,71 @@ static const ssh_key_type_spec_t ssh_key_types[] =
     {
       "ssh-ed25519", "Ed25519", GCRY_PK_EDDSA, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_eddsa,
-      "Ed25519", 0,               SPEC_FLAG_IS_EdDSA
+      "Ed25519", NULL, 0,   SPEC_FLAG_IS_EdDSA
     },
     {
       "ssh-rsa", "RSA", GCRY_PK_RSA, "nedupq", "en",   "s",  "nedpqu",
       ssh_key_modifier_rsa, ssh_signature_encoder_rsa,
-      NULL, 0,                    SPEC_FLAG_USE_PKCS1V2
+      NULL, NULL, 0,        SPEC_FLAG_USE_PKCS1V2
     },
     {
       "ssh-dss", "DSA", GCRY_PK_DSA, "pqgyx",  "pqgy", "rs", "pqgyx",
       NULL,                 ssh_signature_encoder_dsa,
-      NULL, 0, 0
+      NULL, NULL, 0, 0
     },
     {
       "ecdsa-sha2-nistp256", "ECDSA", GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA
+      "nistp256", "NIST P-256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA
     },
     {
       "ecdsa-sha2-nistp384", "ECDSA", GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA
+      "nistp384", "NIST P-384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA
     },
     {
       "ecdsa-sha2-nistp521", "ECDSA", GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA
+      "nistp521", "NIST P-521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA
     },
     {
       "ssh-ed25519-cert-v01 at openssh.com", "Ed25519",
       GCRY_PK_EDDSA, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_eddsa,
-      "Ed25519", 0, SPEC_FLAG_IS_EdDSA | SPEC_FLAG_WITH_CERT
+      "Ed25519", NULL, 0,   SPEC_FLAG_IS_EdDSA | SPEC_FLAG_WITH_CERT
     },
     {
       "ssh-rsa-cert-v01 at openssh.com", "RSA",
       GCRY_PK_RSA, "nedupq", "en",   "s",  "nedpqu",
       ssh_key_modifier_rsa, ssh_signature_encoder_rsa,
-      NULL, 0, SPEC_FLAG_USE_PKCS1V2 | SPEC_FLAG_WITH_CERT
+      NULL, NULL, 0, SPEC_FLAG_USE_PKCS1V2 | SPEC_FLAG_WITH_CERT
     },
     {
       "ssh-dss-cert-v01 at openssh.com", "DSA",
       GCRY_PK_DSA, "pqgyx",  "pqgy", "rs", "pqgyx",
       NULL,                 ssh_signature_encoder_dsa,
-      NULL, 0, SPEC_FLAG_WITH_CERT | SPEC_FLAG_WITH_CERT
+      NULL, NULL, 0, SPEC_FLAG_WITH_CERT | SPEC_FLAG_WITH_CERT
     },
     {
       "ecdsa-sha2-nistp256-cert-v01 at openssh.com", "ECDSA",
       GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
+      "nistp256", "NIST P-256", GCRY_MD_SHA256,
+                                SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
     },
     {
       "ecdsa-sha2-nistp384-cert-v01 at openssh.com", "ECDSA",
       GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
+      "nistp384", "NIST P-384", GCRY_MD_SHA384,
+                                SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
     },
     {
       "ecdsa-sha2-nistp521-cert-v01 at openssh.com", "ECDSA",
       GCRY_PK_ECC, "qd",  "q", "rs", "qd",
       NULL,                 ssh_signature_encoder_ecdsa,
-      "nistp521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
+      "nistp521", "NIST P-521", GCRY_MD_SHA512,
+                                SPEC_FLAG_IS_ECDSA | SPEC_FLAG_WITH_CERT
     }
   };
 
@@ -384,16 +392,24 @@ realloc_secure (void *a, size_t n)
 
 
 /* Lookup the ssh-identifier for the ECC curve CURVE_NAME.  Returns
-   NULL if not found.  */
+ * NULL if not found.  If found the ssh indetifier is returned and a
+ * pointer to the canonical curve name as specified for ssh is stored
+ * at R_CANON_NAME.  */
 static const char *
-ssh_identifier_from_curve_name (const char *curve_name)
+ssh_identifier_from_curve_name (const char *curve_name,
+                                const char **r_canon_name)
 {
   int i;
 
   for (i = 0; i < DIM (ssh_key_types); i++)
     if (ssh_key_types[i].curve_name
-        && !strcmp (ssh_key_types[i].curve_name, curve_name))
-      return ssh_key_types[i].ssh_identifier;
+        && (!strcmp (ssh_key_types[i].curve_name, curve_name)
+            || (ssh_key_types[i].alt_curve_name
+                && !strcmp (ssh_key_types[i].alt_curve_name, curve_name))))
+      {
+        *r_canon_name = ssh_key_types[i].curve_name;
+        return ssh_key_types[i].ssh_identifier;
+      }
 
   return NULL;
 }
@@ -1844,7 +1860,6 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
   gpg_error_t err = 0;
   gcry_sexp_t value_list = NULL;
   gcry_sexp_t value_pair = NULL;
-  char *curve_name = NULL;
   estream_t stream = NULL;
   void *blob = NULL;
   size_t blob_size;
@@ -1862,7 +1877,7 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
       goto out;
     }
 
-  /* Get the type of the key extpression.  */
+  /* Get the type of the key expression.  */
   data = gcry_sexp_nth_data (sexp, 0, &datalen);
   if (!data)
     {
@@ -1893,49 +1908,17 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
   /* Write the ssh algorithm identifier.  */
   if ((key_spec.flags & SPEC_FLAG_IS_ECDSA))
     {
-      /* Parse the "curve" parameter.  We currently expect the curve
-         name for ECC and not the parameters of the curve.  This can
-         easily be changed but then we need to find the curve name
-         from the parameters using gcry_pk_get_curve.  */
-      const char *mapped;
-      const char *sshname;
-
-      gcry_sexp_release (value_pair);
-      value_pair = gcry_sexp_find_token (value_list, "curve", 5);
-      if (!value_pair)
-	{
-	  err = gpg_error (GPG_ERR_INV_CURVE);
-	  goto out;
-        }
-      curve_name = gcry_sexp_nth_string (value_pair, 1);
-      if (!curve_name)
-	{
-	  err = gpg_error (GPG_ERR_INV_CURVE); /* (Or out of core.)  */
-	  goto out;
-        }
+      /* Map the curve name to the ssh name.  */
+      const char *name, *sshname, *canon_name;
 
-      /* Fixme: The mapping should be done by using gcry_pk_get_curve
-         et al to iterate over all name aliases.  */
-      if (!strcmp (curve_name, "NIST P-256"))
-        mapped = "nistp256";
-      else if (!strcmp (curve_name, "NIST P-384"))
-        mapped = "nistp384";
-      else if (!strcmp (curve_name, "NIST P-521"))
-        mapped = "nistp521";
-      else
-        mapped = NULL;
-      if (mapped)
+      name = gcry_pk_get_curve (sexp, 0, NULL);
+      if (!name)
         {
-          xfree (curve_name);
-          curve_name = xtrystrdup (mapped);
-          if (!curve_name)
-            {
-              err = gpg_error_from_syserror ();
-              goto out;
-            }
+          err = gpg_error (GPG_ERR_INV_CURVE);
+          goto out;
         }
 
-      sshname = ssh_identifier_from_curve_name (curve_name);
+      sshname = ssh_identifier_from_curve_name (name, &canon_name);
       if (!sshname)
         {
           err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
@@ -1944,7 +1927,7 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
       err = stream_write_cstring (stream, sshname);
       if (err)
         goto out;
-      err = stream_write_cstring (stream, curve_name);
+      err = stream_write_cstring (stream, canon_name);
       if (err)
         goto out;
     }
@@ -2017,7 +2000,6 @@ ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
  out:
   gcry_sexp_release (value_list);
   gcry_sexp_release (value_pair);
-  xfree (curve_name);
   es_fclose (stream);
   es_free (blob);
 
@@ -2076,7 +2058,7 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
   ssh_key_type_spec_t spec;
   gcry_mpi_t *mpi_list = NULL;
   const char *elems;
-  char *curve_name = NULL;
+  const char *curve_name = NULL;
 
 
   err = stream_read_cstring (stream, &key_type);
@@ -2199,34 +2181,19 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
        * certificate.
        */
       unsigned char *buffer;
-      const char *mapped;
 
       err = stream_read_string (cert? cert : stream, 0, &buffer, NULL);
       if (err)
         goto out;
-      curve_name = buffer;
-      /* Fixme: Check that curve_name matches the keytype.  */
-      /* Because Libgcrypt < 1.6 has no support for the "nistpNNN"
-         curve names, we need to translate them here to Libgcrypt's
-         native names.  */
-      if (!strcmp (curve_name, "nistp256"))
-        mapped = "NIST P-256";
-      else if (!strcmp (curve_name, "nistp384"))
-        mapped = "NIST P-384";
-      else if (!strcmp (curve_name, "nistp521"))
-        mapped = "NIST P-521";
-      else
-        mapped = NULL;
-      if (mapped)
+      /* Get the canonical name.  Should be the same as the read
+       * string but we use this mapping to validate that name.  */
+      if (!ssh_identifier_from_curve_name (buffer, &curve_name))
         {
-          xfree (curve_name);
-          curve_name = xtrystrdup (mapped);
-          if (!curve_name)
-            {
-              err = gpg_error_from_syserror ();
-              goto out;
-            }
+          err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
+          xfree (buffer);
+          goto out;
         }
+      xfree (buffer);
 
       err = ssh_receive_mpint_list (stream, secret, &spec, cert, &mpi_list);
       if (err)
@@ -2294,7 +2261,6 @@ ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
  out:
   es_fclose (cert);
   mpint_list_free (mpi_list);
-  xfree (curve_name);
   xfree (key_type);
   xfree (comment);
 
@@ -2642,6 +2608,8 @@ ssh_handler_request_identities (ctrl_t ctrl,
             continue;
 
           err = ssh_send_key_public (key_blobs, key_public, cardsn);
+          if (err && opt.verbose)
+            gcry_log_debugsxp ("pubkey", key_public);
           gcry_sexp_release (key_public);
           key_public = NULL;
           xfree (cardsn);
@@ -2717,6 +2685,8 @@ ssh_handler_request_identities (ctrl_t ctrl,
     }
   else
     {
+      log_error ("ssh request identities failed: %s <%s>\n",
+                 gpg_strerror (err), gpg_strsource (err));
       ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
     }
 

commit f5d3b982e44c5cfc60e9936020102a598b635187
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 22 10:06:15 2019 +0100

    gpg: Stop early when trying to create a primary Elgamal key.
    
    * g10/misc.c (openpgp_pk_test_algo2): Add extra check.
    --
    
    The problem is that --key-gen --batch with a parameter file didn't
    detect that Elgamal is not capable of signing and so an error was only
    triggered at the time the self-signature was created.  See the code
    comment for details.
    
    GnuPG-bug-id: 4329
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit f97dc55ff1b041071bc3cbe98aa761bf77bb7ac8)

diff --git a/g10/misc.c b/g10/misc.c
index 9780969..7acf469 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -644,6 +644,13 @@ openpgp_pk_test_algo2 (pubkey_algo_t algo, unsigned int use)
   if (!ga)
     return gpg_error (GPG_ERR_PUBKEY_ALGO);
 
+  /* Elgamal in OpenPGP used to support signing and Libgcrypt still
+   * does.  However, we removed the signing capability from gpg ages
+   * ago.  This function should reflect this so that errors are thrown
+   * early and not only when we try to sign using Elgamal.  */
+  if (ga == GCRY_PK_ELG && (use & (PUBKEY_USAGE_CERT | PUBKEY_USAGE_SIG)))
+    return gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
+
   /* Now check whether Libgcrypt has support for the algorithm.  */
   return gcry_pk_algo_info (ga, GCRYCTL_TEST_ALGO, NULL, &use_buf);
 }

-----------------------------------------------------------------------

Summary of changes:
 agent/command-ssh.c | 138 ++++++++++++++++++++--------------------------------
 doc/gpg.texi        |  30 ++----------
 g10/misc.c          |   7 +++
 po/Makevars         |   1 +
 scd/apdu.c          |  30 ++++++++----
 scd/apdu.h          |   2 +-
 scd/app-common.h    |   5 +-
 scd/app-nks.c       |   7 ++-
 scd/app-openpgp.c   |   4 ++
 scd/app.c           |   2 +-
 scd/command.c       |  39 +++++++++++++--
 scd/iso7816.c       |  67 ++++++++++++++++++++-----
 scd/iso7816.h       |   9 +++-
 scd/scdaemon.h      |   3 ++
 14 files changed, 202 insertions(+), 142 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 23 04:16:03 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 23 Jan 2019 04:16:03 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-326-gfec75a3
Message-ID: <E1gm91I-0000xW-Gy@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  fec75a3868da72196f76aca95c7ab07debb7dc04 (commit)
      from  f97dc55ff1b041071bc3cbe98aa761bf77bb7ac8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fec75a3868da72196f76aca95c7ab07debb7dc04
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 23 12:01:51 2019 +0900

    scd: Support PASSWD --clear for OpenPGP card.
    
    * scd/app-openpgp.c (do_change_pin): Implement handling
    APP_CHANGE_FLAG_CLEAR.
    
    --
    
    It is specified in the specification version 3.1 or later.  Some
    version 2 cards (including Gnuk) support this feature.  Any version 1
    card has no support for this feature.
    
    For CHVNO = 1, it clears for both of 81 and 82; That is, user's key
    usages for signing and others (decryption and auth).
    For CHVNO = 3, it clears for 83, admin key.
    
    For CHVNO = 2, it clears 82; That is, user's key usages
    others (decryption and auth).
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index fddc3b8..db5188e 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -2608,7 +2608,38 @@ do_change_pin (app_t app, ctrl_t ctrl,  const char *chvnostr,
   pininfo.minlen = minlen;
 
   if ((flags & APP_CHANGE_FLAG_CLEAR))
-    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+    {
+      unsigned char apdu[4];
+
+      if (!app->app_local->extcap.is_v2)
+        return GPG_ERR_UNSUPPORTED_OPERATION;
+
+      apdu[0] = 0x00;
+      apdu[1] = ISO7816_VERIFY;
+      apdu[2] = 0xff;
+      apdu[3] = 0x80+chvno;
+
+      rc = iso7816_apdu_direct (app->slot, apdu, 4, 0, NULL, NULL, NULL);
+      if (rc)
+        {
+          if (rc == GPG_ERR_INV_VALUE)
+            rc = GPG_ERR_UNSUPPORTED_OPERATION;
+          return rc;
+        }
+
+      if (chvno == 1)
+        {
+          apdu[3]++;
+          rc = iso7816_apdu_direct (app->slot, apdu, 4, 0, NULL, NULL, NULL);
+          app->did_chv1 = app->did_chv2 = 0;
+        }
+      else if (chvno == 2)
+        app->did_chv2 = 0;
+      else if (chvno == 3)
+        app->did_chv3 = 0;
+
+      return rc;
+    }
 
   if (reset_mode && chvno == 3)
     {

-----------------------------------------------------------------------

Summary of changes:
 scd/app-openpgp.c | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 23 08:15:58 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 23 Jan 2019 08:15:58 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.34-2-g8a93978
Message-ID: <E1gmClT-0003Dm-JF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  8a9397896fd202dcfb3fb46259e43bc05a0ddd2e (commit)
      from  2a8978d3504efba4068eb1723498b71286e04de2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8a9397896fd202dcfb3fb46259e43bc05a0ddd2e
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 23 16:12:12 2019 +0900

    gpgscm: Build well even if NDEBUG defined.
    
    * gpgscm/scheme.c (gc_reservation_failure): Fix adding ";".
    [!NDEBUG] (scheme_init_custom_alloc): Don't init seserved_lineno.
    
    --
    
    In some build environment, NDEBUG is defined (although it's
    bad practice).  This change supports such a situation.
    
    GnuPG-bug-id: 3959
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/gpgscm/scheme.c b/gpgscm/scheme.c
index 1b489e4..eb57ba4 100644
--- a/gpgscm/scheme.c
+++ b/gpgscm/scheme.c
@@ -873,7 +873,7 @@ gc_reservation_failure(struct scheme *sc)
 {
 #ifdef NDEBUG
   fprintf(stderr,
-	  "insufficient reservation\n")
+	  "insufficient reservation\n");
 #else
   fprintf(stderr,
 	  "insufficient %s reservation in line %d\n",
@@ -5615,7 +5615,9 @@ int scheme_init_custom_alloc(scheme *sc, func_alloc malloc, func_dealloc free) {
   sc->fcells = 0;
   sc->inhibit_gc = GC_ENABLED;
   sc->reserved_cells = 0;
+#ifndef NDEBUG
   sc->reserved_lineno = 0;
+#endif
   sc->no_memory=0;
   sc->inport=sc->NIL;
   sc->outport=sc->NIL;

-----------------------------------------------------------------------

Summary of changes:
 gpgscm/scheme.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 24 10:04:19 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 24 Jan 2019 10:04:19 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-327-g055f885
Message-ID: <E1gmavt-0007Uc-Lh@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  055f8854d3f49b8d06105d20f344f5ac10e4f6a6 (commit)
      from  fec75a3868da72196f76aca95c7ab07debb7dc04 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 055f8854d3f49b8d06105d20f344f5ac10e4f6a6
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 24 10:02:52 2019 +0100

    common: Extend function percent_data_escape.
    
    * common/percent.c (percent_data_escape): Add new args prefix and
    plus_escape.
    * agent/command.c (cmd_put_secret): Adjust for changed function
    
    * common/t-percent.c (test_percent_data_escape): Extend test for the
    prefix.
    (test_percent_data_escape_plus): new test for the plus escaping.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/command.c b/agent/command.c
index 7fbf1de..c395b1e 100644
--- a/agent/command.c
+++ b/agent/command.c
@@ -2751,7 +2751,7 @@ cmd_put_secret (assuan_context_t ctx, char *line)
    * into a string.  Instead of resorting to base64 encoding we use a
    * special percent escaping which only quoted the Nul and the
    * percent character. */
-  string = percent_data_escape (value? value : valstr, valuelen);
+  string = percent_data_escape (0, NULL, value? value : valstr, valuelen);
   if (!string)
     {
       err = gpg_error_from_syserror ();
diff --git a/common/percent.c b/common/percent.c
index 7b81768..ecc6a19 100644
--- a/common/percent.c
+++ b/common/percent.c
@@ -37,16 +37,16 @@
 
 
 /* Create a newly alloced string from STRING with all spaces and
-   control characters converted to plus signs or %xx sequences.  The
-   function returns the new string or NULL in case of a malloc
-   failure.
-
-   Note that we also escape the quote character to work around a bug
-   in the mingw32 runtime which does not correctly handle command line
-   quoting.  We correctly double the quote mark when calling a program
-   (i.e. gpg-protect-tool), but the pre-main code does not notice the
-   double quote as an escaped quote.  We do this also on POSIX systems
-   for consistency.  */
+ * control characters converted to plus signs or %xx sequences.  The
+ * function returns the new string or NULL in case of a malloc
+ * failure.
+ *
+ * Note that this fucntion also escapes the quote character to work
+ * around a bug in the mingw32 runtime which does not correctly handle
+ * command line quoting.  We correctly double the quote mark when
+ * calling a program (i.e. gpg-protect-tool), but the pre-main code
+ * does not notice the double quote as an escaped quote.  We do this
+ * also on POSIX systems for consistency.  */
 char *
 percent_plus_escape (const char *string)
 {
@@ -87,19 +87,36 @@ percent_plus_escape (const char *string)
 }
 
 
-/* Create a newly alloced string from (DATA,DATALEN) with embedded
- * Nuls quoted as %00.  The standard percent unescaping can be
- * used to reverse this encoding.   */
+/* Create a newly malloced string from (DATA,DATALEN) with embedded
+ * nuls quoted as %00.  The standard percent unescaping can be used to
+ * reverse this encoding.  With PLUS_ESCAPE set plus-escaping (spaces
+ * are replaced by a '+') and escaping of characters with values less
+ * than 0x20 is used.  If PREFIX is not NULL it will be prepended to
+ * the output in standard escape format; that is PLUS_ESCAPING is
+ * ignored for PREFIX. */
 char *
-percent_data_escape (const void *data, size_t datalen)
+percent_data_escape (int plus_escape, const char *prefix,
+                     const void *data, size_t datalen)
 {
   char *buffer, *p;
-  const char *s;
-  size_t n, length;
+  const unsigned char *s;
+  size_t n;
+  size_t length = 1;
+
+  if (prefix)
+    {
+      for (s = prefix; *s; s++)
+        {
+          if (*s == '%' || *s < 0x20)
+            length += 3;
+          else
+            length++;
+        }
+    }
 
-  for (length=1, s=data, n=datalen; n; s++, n--)
+  for (s=data, n=datalen; n; s++, n--)
     {
-      if (!*s || *s == '%')
+      if (!*s || *s == '%' || (plus_escape && (*s < ' ' || *s == '+')))
         length += 3;
       else
         length++;
@@ -109,6 +126,20 @@ percent_data_escape (const void *data, size_t datalen)
   if (!buffer)
     return NULL;
 
+  if (prefix)
+    {
+      for (s = prefix; *s; s++)
+        {
+          if (*s == '%' || *s < 0x20)
+            {
+              snprintf (p, 4, "%%%02X", *s);
+              p += 3;
+            }
+          else
+            *p++ = *s;
+        }
+    }
+
   for (s=data, n=datalen; n; s++, n--)
     {
       if (!*s)
@@ -121,13 +152,21 @@ percent_data_escape (const void *data, size_t datalen)
           memcpy (p, "%25", 3);
           p += 3;
         }
+      else if (plus_escape && *s == ' ')
+        {
+          *p++ = '+';
+        }
+      else if (plus_escape && (*s < ' ' || *s == '+'))
+        {
+          snprintf (p, 4, "%%%02X", *s);
+          p += 3;
+        }
       else
         *p++ = *s;
     }
   *p = 0;
 
   return buffer;
-
 }
 
 
diff --git a/common/t-percent.c b/common/t-percent.c
index 94ece92..774fa80 100644
--- a/common/t-percent.c
+++ b/common/t-percent.c
@@ -103,25 +103,182 @@ static void
 test_percent_data_escape (void)
 {
   static struct {
+    const char *prefix;
     const char *data;
     size_t datalen;
     const char *expect;
   } tbl[] = {
     {
+      NULL,
       "", 0,
       ""
     }, {
+      NULL,
       "a", 1,
       "a",
     }, {
+      NULL,
       "%22", 3,
       "%2522"
     }, {
+      NULL,
       "%%", 3,
       "%25%25%00"
     }, {
+      NULL,
       "\n \0BC\t", 6,
       "\n %00BC\t"
+    }, {
+      "",
+      "", 0,
+      ""
+    }, {
+      "",
+      "a", 1,
+      "a",
+    }, {
+      "",
+      "%22", 3,
+      "%2522"
+    }, {
+      "",
+      "%%", 3,
+      "%25%25%00"
+    }, {
+      "",
+      "\n \0BC\t", 6,
+      "\n %00BC\t"
+    }, {
+      "a",
+      "", 0,
+      "a"
+    }, {
+      "a",
+      "a", 1,
+      "aa",
+    }, {
+      "a",
+      "%22", 3,
+      "a%2522"
+    }, {
+      "a",
+      "%%", 3,
+      "a%25%25%00"
+    }, {
+      "a",
+      "\n \0BC\t", 6,
+      "a\n %00BC\t"
+    }, {
+      " ",
+      "%%", 3,
+      " %25%25%00"
+    }, {
+      "+",
+      "%%", 3,
+      "+%25%25%00"
+    }, {
+      "%",
+      "%%", 3,
+      "%25%25%25%00"
+    }, {
+      "a b",
+      "%%", 3,
+      "a b%25%25%00"
+    }, {
+      "a%2Bb",
+      "%%", 3,
+      "a%252Bb%25%25%00"
+    }, {
+      "\n",
+      "%%", 3,
+      "%0A%25%25%00"
+    }, {
+      NULL,
+      NULL, 0,
+      NULL }
+  };
+  char *buf;
+  int i;
+  size_t len, prefixlen;
+
+  for (i=0; tbl[i].data; i++)
+    {
+      buf = percent_data_escape (0, tbl[i].prefix, tbl[i].data, tbl[i].datalen);
+      if (!buf)
+        {
+          fprintf (stderr, "out of core: %s\n", strerror (errno));
+          exit (2);
+        }
+      if (strcmp (buf, tbl[i].expect))
+        {
+          fail (i);
+        }
+      len = percent_plus_unescape_inplace (buf, 0);
+      prefixlen = tbl[i].prefix? strlen (tbl[i].prefix) : 0;
+      if (len != tbl[i].datalen + prefixlen)
+        fail (i);
+      else if (tbl[i].prefix && memcmp (buf, tbl[i].prefix, prefixlen)
+               && !(prefixlen == 1 && *tbl[i].prefix == '+' && *buf == ' '))
+        {
+          /* Note extra condition above handles the one test case
+           * which reverts a plus to a space due to the use of the
+           * plus-unescape fucntion also for the prefix part.  */
+          fail (i);
+        }
+      else if (memcmp (buf+prefixlen, tbl[i].data, tbl[i].datalen))
+        {
+          fail (i);
+        }
+      xfree (buf);
+    }
+}
+
+
+
+static void
+test_percent_data_escape_plus (void)
+{
+  static struct {
+    const char *data;
+    size_t datalen;
+    const char *expect;
+  } tbl[] = {
+    {
+      "", 0,
+      ""
+    }, {
+      "a", 1,
+      "a",
+    }, {
+      "%22", 3,
+      "%2522"
+    }, {
+      "%%", 3,
+      "%25%25%00"
+    }, {
+      "\n \0BC\t", 6,
+      "%0A+%00BC%09"
+    }, {
+      " ", 1,
+      "+"
+    }, {
+      "  ", 2,
+      "++"
+    }, {
+      "+ +", 3,
+      "%2B+%2B"
+    }, {
+      "\" \"", 3,  /* Note: This function does not escape quotes.  */
+      "\"+\""
+    }, {
+      "%22", 3,
+      "%2522"
+    }, {
+      "%% ", 3,
+      "%25%25+"
+    }, {
+      "\n ABC\t", 6,
+      "%0A+ABC%09"
     }, { NULL, 0, NULL }
   };
   char *buf;
@@ -130,14 +287,16 @@ test_percent_data_escape (void)
 
   for (i=0; tbl[i].data; i++)
     {
-      buf = percent_data_escape (tbl[i].data, tbl[i].datalen);
+      buf = percent_data_escape (1, NULL, tbl[i].data, tbl[i].datalen);
       if (!buf)
         {
           fprintf (stderr, "out of core: %s\n", strerror (errno));
           exit (2);
         }
       if (strcmp (buf, tbl[i].expect))
-        fail (i);
+        {
+          fail (i);
+        }
       len = percent_plus_unescape_inplace (buf, 0);
       if (len != tbl[i].datalen)
         fail (i);
@@ -148,16 +307,15 @@ test_percent_data_escape (void)
 }
 
 
-
 int
 main (int argc, char **argv)
 {
   (void)argc;
   (void)argv;
 
-  /* FIXME: We escape_unescape is not tested - only
-     percent_plus_unescape.  */
+  /* FIXME: escape_unescape is not tested - only percent_plus_unescape.  */
   test_percent_plus_escape ();
   test_percent_data_escape ();
+  test_percent_data_escape_plus ();
   return 0;
 }
diff --git a/common/util.h b/common/util.h
index 682415d..d3a846f 100644
--- a/common/util.h
+++ b/common/util.h
@@ -201,7 +201,8 @@ char *hex2str_alloc (const char *hexstring, size_t *r_count);
 
 /*-- percent.c --*/
 char *percent_plus_escape (const char *string);
-char *percent_data_escape (const void *data, size_t datalen);
+char *percent_data_escape (int plus, const char *prefix,
+                           const void *data, size_t datalen);
 char *percent_plus_unescape (const char *string, int nulrepl);
 char *percent_unescape (const char *string, int nulrepl);
 

-----------------------------------------------------------------------

Summary of changes:
 agent/command.c    |   2 +-
 common/percent.c   |  77 ++++++++++++++++++------
 common/t-percent.c | 168 +++++++++++++++++++++++++++++++++++++++++++++++++++--
 common/util.h      |   3 +-
 4 files changed, 224 insertions(+), 26 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 03:38:25 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 25 Jan 2019 03:38:25 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-328-g1f88174
Message-ID: <E1gmrNy-0004Zu-UW@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  1f8817475f59ede3f28f57edc10ba56bbdd08b49 (commit)
      from  055f8854d3f49b8d06105d20f344f5ac10e4f6a6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1f8817475f59ede3f28f57edc10ba56bbdd08b49
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 25 10:15:39 2019 +0900

    dirmngr: Fix initialization of assuan's nPth hook.
    
    * dirmngr/dirmngr.c (main): Move assuan_set_system_hooks to...
    (thread_init): ... here.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 80fb134..5b9e7a8 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -802,6 +802,7 @@ static void
 thread_init (void)
 {
   npth_init ();
+  assuan_set_system_hooks (ASSUAN_SYSTEM_NPTH);
   gpgrt_set_syscall_clamp (npth_unprotect, npth_protect);
 
   /* Now with NPth running we can set the logging callback.  Our
@@ -877,7 +878,6 @@ main (int argc, char **argv)
   assuan_set_malloc_hooks (&malloc_hooks);
   assuan_set_assuan_log_prefix (log_get_prefix (NULL));
   assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
-  assuan_set_system_hooks (ASSUAN_SYSTEM_NPTH);
   assuan_sock_init ();
   setup_libassuan_logging (&opt.debug, dirmngr_assuan_log_monitor);
 

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 03:39:57 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 25 Jan 2019 03:39:57 +0100
Subject: [git] Assuan - branch, master, updated. libassuan-2.5.2-3-g5e48116
Message-ID: <E1gmrPS-0004cD-7F@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPC library used by GnuPG".

The branch, master has been updated
       via  5e48116051a476e1dcf5f66d9e21d8003b27ad20 (commit)
      from  23bf875954329458c0ac6c31e253cba44db8a648 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5e48116051a476e1dcf5f66d9e21d8003b27ad20
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 25 11:34:15 2019 +0900

    socks5: Implement timeout to detect bogus service.
    
    * src/assuan-socket.c (TIMEOUT_NOT_WAITING_SOCKS5_FOREVER): New.
    (socks5_connect): Call 'select' in order to not waiting response
    forever.
    
    --
    
    GnuPG-bug-id: 3381
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/src/assuan-socket.c b/src/assuan-socket.c
index 7644ada..91b5f45 100644
--- a/src/assuan-socket.c
+++ b/src/assuan-socket.c
@@ -690,6 +690,8 @@ do_writen (assuan_context_t ctx, assuan_fd_t sockfd,
 }
 
 
+#define TIMEOUT_NOT_WAITING_SOCKS5_FOREVER 1 /* in second(s) */
+
 /* Connect using the SOCKS5 protocol. */
 static int
 socks5_connect (assuan_context_t ctx, assuan_fd_t sock,
@@ -713,9 +715,14 @@ socks5_connect (assuan_context_t ctx, assuan_fd_t sock,
                                    hostname. */
   size_t buflen, hostnamelen;
   int method;
+  fd_set fds;
+  struct timeval tv = { TIMEOUT_NOT_WAITING_SOCKS5_FOREVER, 0 };
 
   addru.addr = addr;
 
+  FD_ZERO (&fds);
+  FD_SET (HANDLE2SOCKET (sock), &fds);
+
   /* memset (&proxyaddr_in6, 0, sizeof proxyaddr_in6); */
   memset (&proxyaddr_in, 0, sizeof proxyaddr_in);
 
@@ -770,6 +777,25 @@ socks5_connect (assuan_context_t ctx, assuan_fd_t sock,
   ret = do_writen (ctx, sock, buffer, 3);
   if (ret)
     return ret;
+
+  /* There may be a different service at the port, which doesn't
+     respond.  Not to be bothred by such a service.  */
+  /* FIXME: Since the process may block on select, it should be
+     npth_select to release thread scheduling if nPth is enabled.
+     Ideally, select is better to be in the system hooks.  However, it
+     is considered OK to use select directly; Normal use case is three
+     steps: detect SOCKS5 service before nPth use, configure nPth
+     system hooks, and then use socks5_connect.  For the first call,
+     select indeed blocks, but it's only single thread.  For
+     succeeding calls, this select should soon return successfully.
+   */
+  ret = select (sock+1, &fds, NULL, NULL, &tv);
+  if (!ret)
+    {
+      gpg_err_set_errno (ETIMEDOUT);
+      return -1;
+    }
+
   ret = do_readn (ctx, sock, buffer, 2);
   if (ret)
     return ret;

-----------------------------------------------------------------------

Summary of changes:
 src/assuan-socket.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)


hooks/post-receive
-- 
IPC library used by GnuPG
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 04:09:46 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 25 Jan 2019 04:09:46 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-329-gae966bb
Message-ID: <E1gmrsK-0002qC-5R@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ae966bbe9b16ed68a51391afdde615339755e22d (commit)
      from  1f8817475f59ede3f28f57edc10ba56bbdd08b49 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ae966bbe9b16ed68a51391afdde615339755e22d
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 25 12:08:09 2019 +0900

    agent: Support --mode=ssh option for CLEAR_PASSPHRASE.
    
    * agent/command.c (cmd_clear_passphrase): Add support for SSH.
    
    --
    
    GnuPG-bug-id: 4340
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/agent/command.c b/agent/command.c
index c395b1e..332d20f 100644
--- a/agent/command.c
+++ b/agent/command.c
@@ -1595,19 +1595,24 @@ static const char hlp_clear_passphrase[] =
   "may be used to invalidate the cache entry for a passphrase.  The\n"
   "function returns with OK even when there is no cached passphrase.\n"
   "The --mode=normal option is used to clear an entry for a cacheid\n"
-  "added by the agent.\n";
+  "added by the agent.  The --mode=ssh option is used for a cacheid\n"
+  "added for ssh.\n";
 static gpg_error_t
 cmd_clear_passphrase (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   char *cacheid = NULL;
   char *p;
-  int opt_normal;
+  cache_mode_t cache_mode = CACHE_MODE_USER;
 
   if (ctrl->restricted)
     return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));
 
-  opt_normal = has_option (line, "--mode=normal");
+  if (has_option (line, "--mode=normal"))
+    cache_mode = CACHE_MODE_NORMAL;
+  else if (has_option (line, "--mode=ssh"))
+    cache_mode = CACHE_MODE_SSH;
+
   line = skip_options (line);
 
   /* parse the stuff */
@@ -1620,12 +1625,9 @@ cmd_clear_passphrase (assuan_context_t ctx, char *line)
   if (!*cacheid || strlen (cacheid) > 50)
     return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of cacheID");
 
-  agent_put_cache (ctrl, cacheid,
-                   opt_normal ? CACHE_MODE_NORMAL : CACHE_MODE_USER,
-                   NULL, 0);
+  agent_put_cache (ctrl, cacheid, cache_mode, NULL, 0);
 
-  agent_clear_passphrase (ctrl, cacheid,
-			  opt_normal ? CACHE_MODE_NORMAL : CACHE_MODE_USER);
+  agent_clear_passphrase (ctrl, cacheid, cache_mode);
 
   return 0;
 }

-----------------------------------------------------------------------

Summary of changes:
 agent/command.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 09:39:02 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 25 Jan 2019 09:39:02 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-330-gc9f4c1f
Message-ID: <E1gmx0y-0001en-O8@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c9f4c1f0de06672c6ae2b793d86cc001d131f9a6 (commit)
      from  ae966bbe9b16ed68a51391afdde615339755e22d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c9f4c1f0de06672c6ae2b793d86cc001d131f9a6
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 25 09:37:19 2019 +0100

    scd: Fix flushing of CA-FPR data objects
    
    * scd/app-openpgp.c (do_setattr): Add new table item to flush a
    different tag.
    
    --
    
    For whatever reasons the OpenPGP card reads the 3 CA fingerprints from
    one object but sets them individually using 3 different tags.  The
    cache flushing was not prepared for this and so a changed CA
    fingerprint showed only up after a card reset.  This patch fixes it.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index db5188e..dbc51be 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -2451,32 +2451,33 @@ do_setattr (app_t app, const char *name,
   static struct {
     const char *name;
     int tag;
+    int flush_tag;  /* The tag which needs to be flushed or 0. */
     int need_chv;
     int special;
     unsigned int need_v2:1;
   } table[] = {
-    { "DISP-NAME",    0x005B, 3 },
-    { "LOGIN-DATA",   0x005E, 3, 2 },
-    { "DISP-LANG",    0x5F2D, 3 },
-    { "DISP-SEX",     0x5F35, 3 },
-    { "PUBKEY-URL",   0x5F50, 3 },
-    { "CHV-STATUS-1", 0x00C4, 3, 1 },
-    { "CA-FPR-1",     0x00CA, 3 },
-    { "CA-FPR-2",     0x00CB, 3 },
-    { "CA-FPR-3",     0x00CC, 3 },
-    { "PRIVATE-DO-1", 0x0101, 2 },
-    { "PRIVATE-DO-2", 0x0102, 3 },
-    { "PRIVATE-DO-3", 0x0103, 2 },
-    { "PRIVATE-DO-4", 0x0104, 3 },
-    { "CERT-3",       0x7F21, 3, 0, 1 },
-    { "SM-KEY-ENC",   0x00D1, 3, 0, 1 },
-    { "SM-KEY-MAC",   0x00D2, 3, 0, 1 },
-    { "KEY-ATTR",     0,      0, 3, 1 },
-    { "AESKEY",       0x00D5, 3, 0, 1 },
-    { "UIF-1",        0x00D6, 3, 5, 1 },
-    { "UIF-2",        0x00D7, 3, 5, 1 },
-    { "UIF-3",        0x00D8, 3, 5, 1 },
-    { "KDF",          0x00F9, 3, 4, 1 },
+    { "DISP-NAME",    0x005B, 0,      3 },
+    { "LOGIN-DATA",   0x005E, 0,      3, 2 },
+    { "DISP-LANG",    0x5F2D, 0,      3 },
+    { "DISP-SEX",     0x5F35, 0,      3 },
+    { "PUBKEY-URL",   0x5F50, 0,      3 },
+    { "CHV-STATUS-1", 0x00C4, 0,      3, 1 },
+    { "CA-FPR-1",     0x00CA, 0x00C6, 3 },
+    { "CA-FPR-2",     0x00CB, 0x00C6, 3 },
+    { "CA-FPR-3",     0x00CC, 0x00C6, 3 },
+    { "PRIVATE-DO-1", 0x0101, 0,      2 },
+    { "PRIVATE-DO-2", 0x0102, 0,      3 },
+    { "PRIVATE-DO-3", 0x0103, 0,      2 },
+    { "PRIVATE-DO-4", 0x0104, 0,      3 },
+    { "CERT-3",       0x7F21, 0,      3, 0, 1 },
+    { "SM-KEY-ENC",   0x00D1, 0,      3, 0, 1 },
+    { "SM-KEY-MAC",   0x00D2, 0,      3, 0, 1 },
+    { "KEY-ATTR",     0,      0,      0, 3, 1 },
+    { "AESKEY",       0x00D5, 0,      3, 0, 1 },
+    { "UIF-1",        0x00D6, 0,      3, 5, 1 },
+    { "UIF-2",        0x00D7, 0,      3, 5, 1 },
+    { "UIF-3",        0x00D8, 0,      3, 5, 1 },
+    { "KDF",          0x00F9, 0,      3, 4, 1 },
     { NULL, 0 }
   };
   int exmode;
@@ -2511,7 +2512,8 @@ do_setattr (app_t app, const char *name,
   /* Flush the cache before writing it, so that the next get operation
      will reread the data from the card and thus get synced in case of
      errors (e.g. data truncated by the card). */
-  flush_cache_item (app, table[idx].tag);
+  flush_cache_item (app, table[idx].flush_tag? table[idx].flush_tag
+                    /* */                    : table[idx].tag);
 
   if (app->app_local->cardcap.ext_lc_le && valuelen > 254)
     exmode = 1;    /* Use extended length w/o a limit.  */

-----------------------------------------------------------------------

Summary of changes:
 scd/app-openpgp.c | 48 +++++++++++++++++++++++++-----------------------
 1 file changed, 25 insertions(+), 23 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 13:46:03 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 25 Jan 2019 13:46:03 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-124-g7f24233
Message-ID: <E1gn0s0-0005wE-Mm@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  7f2423371964263784252cf839269023b6573bd2 (commit)
      from  66bcb8acb2452cf19318023ed0ff1ea7d7bb8439 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7f2423371964263784252cf839269023b6573bd2
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 25 13:31:47 2019 +0100

    json: Fix minor memory leaks.
    
    * src/gpgme-json.c (interactive_repl): Fix memleak.
    (subkey_to_json): Ditto
    (op_config): Delay init of j_comps to avoid a leak on error.
    --
    
    GnuPG-bug-id: 4341, 4342, 4343
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/gpgme-json.c b/src/gpgme-json.c
index e4ae81d..232bc50 100644
--- a/src/gpgme-json.c
+++ b/src/gpgme-json.c
@@ -1003,6 +1003,7 @@ static cjson_t
 subkey_to_json (gpgme_subkey_t sub)
 {
   cjson_t result = xjson_CreateObject ();
+  char *tmp;
 
   xjson_AddBoolToObject (result, "revoked", sub->revoked);
   xjson_AddBoolToObject (result, "expired", sub->expired);
@@ -1016,11 +1017,13 @@ subkey_to_json (gpgme_subkey_t sub)
   xjson_AddBoolToObject (result, "is_qualified", sub->is_qualified);
   xjson_AddBoolToObject (result, "is_cardkey", sub->is_cardkey);
   xjson_AddBoolToObject (result, "is_de_vs", sub->is_de_vs);
-
   xjson_AddStringToObject0 (result, "pubkey_algo_name",
                             gpgme_pubkey_algo_name (sub->pubkey_algo));
-  xjson_AddStringToObject0 (result, "pubkey_algo_string",
-                            gpgme_pubkey_algo_string (sub));
+
+  tmp = gpgme_pubkey_algo_string (sub);
+  xjson_AddStringToObject0 (result, "pubkey_algo_string", tmp);
+  xfree (tmp);
+
   xjson_AddStringToObject0 (result, "keyid", sub->keyid);
   xjson_AddStringToObject0 (result, "card_number", sub->card_number);
   xjson_AddStringToObject0 (result, "curve", sub->curve);
@@ -2925,7 +2928,7 @@ op_config (cjson_t request, cjson_t result)
   gpgme_conf_comp_t comp = NULL;
   cjson_t j_tmp;
   char *comp_name = NULL;
-  cjson_t j_comps = xjson_CreateArray ();
+  cjson_t j_comps;
 
   ctx = get_context (GPGME_PROTOCOL_GPGCONF);
 
@@ -2947,6 +2950,7 @@ op_config (cjson_t request, cjson_t result)
       goto leave;
     }
 
+  j_comps = xjson_CreateArray ();
   comp = conf;
   for (comp = conf; comp; comp = comp->next)
     {
@@ -2959,7 +2963,7 @@ op_config (cjson_t request, cjson_t result)
     }
   xjson_AddItemToObject (result, "components", j_comps);
 
-leave:
+ leave:
   gpgme_conf_release (conf);
   release_context (ctx);
 
@@ -3563,7 +3567,11 @@ interactive_repl (void)
           if (!request)
             request = xstrdup (line);
           else
-            request = xstrconcat (request, "\n", line, NULL);
+            {
+              char *tmp = xstrconcat (request, "\n", line, NULL);
+              xfree (request);
+              request = tmp;
+            }
         }
 
       if (!line)

-----------------------------------------------------------------------

Summary of changes:
 src/gpgme-json.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 13:55:27 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 25 Jan 2019 13:55:27 +0100
Subject: [git] Assuan - branch, master, updated. libassuan-2.5.2-4-g75770b1
Message-ID: <E1gn116-0007Oe-Sn@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPC library used by GnuPG".

The branch, master has been updated
       via  75770b1131e11075c82031bdb220591154df9e64 (commit)
      from  5e48116051a476e1dcf5f66d9e21d8003b27ad20 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 75770b1131e11075c82031bdb220591154df9e64
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 25 13:54:59 2019 +0100

    socks5: Fix compiler warning on Windows.
    
    * src/assuan-socket.c (socks5_connect): Use cast macro to get the
    hightest socket number.
    --
    
    GnuPG-bug-id: 3381
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/assuan-socket.c b/src/assuan-socket.c
index 91b5f45..bffe480 100644
--- a/src/assuan-socket.c
+++ b/src/assuan-socket.c
@@ -789,7 +789,7 @@ socks5_connect (assuan_context_t ctx, assuan_fd_t sock,
      select indeed blocks, but it's only single thread.  For
      succeeding calls, this select should soon return successfully.
    */
-  ret = select (sock+1, &fds, NULL, NULL, &tv);
+  ret = select (HANDLE2SOCKET (sock)+1, &fds, NULL, NULL, &tv);
   if (!ret)
     {
       gpg_err_set_errno (ETIMEDOUT);

-----------------------------------------------------------------------

Summary of changes:
 src/assuan-socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
IPC library used by GnuPG
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 15:21:27 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 25 Jan 2019 15:21:27 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-125-ged81892
Message-ID: <E1gn2MK-0007Z8-ON@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ed81892917f47dddc23aa99d88733e3f8f344256 (commit)
      from  7f2423371964263784252cf839269023b6573bd2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ed81892917f47dddc23aa99d88733e3f8f344256
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 25 15:20:26 2019 +0100

    json: Better use gpgme_free
    
    * src/gpgme-json.c (subkey_to_json): here
    --
    
    Avoid Windows ugliness of allowing different CRTs in the same
    process.
    
    Fixes-commit: 7f2423371964263784252cf839269023b6573bd2
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/gpgme-json.c b/src/gpgme-json.c
index 232bc50..a8f9dec 100644
--- a/src/gpgme-json.c
+++ b/src/gpgme-json.c
@@ -1022,7 +1022,7 @@ subkey_to_json (gpgme_subkey_t sub)
 
   tmp = gpgme_pubkey_algo_string (sub);
   xjson_AddStringToObject0 (result, "pubkey_algo_string", tmp);
-  xfree (tmp);
+  gpgme_free (tmp);
 
   xjson_AddStringToObject0 (result, "keyid", sub->keyid);
   xjson_AddStringToObject0 (result, "card_number", sub->card_number);

-----------------------------------------------------------------------

Summary of changes:
 src/gpgme-json.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 25 19:13:14 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 25 Jan 2019 19:13:14 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-331-g0415b80
Message-ID: <E1gn5yd-0002yF-Ic@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  0415b80227c52620bece3ae7502f38f24a23e59d (commit)
      from  c9f4c1f0de06672c6ae2b793d86cc001d131f9a6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0415b80227c52620bece3ae7502f38f24a23e59d
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 25 19:12:32 2019 +0100

    scd: Improve app selection for app "undefined".
    
    * scd/app.c (app_new_register): Don't bail out early in undefined
    mode.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/app.c b/scd/app.c
index 8e09555..219cee6 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -305,21 +305,27 @@ app_new_register (int slot, ctrl_t ctrl, const char *name,
         }
     }
 
-  /* For certain error codes, there is no need to try more.  */
-  if (gpg_err_code (err) == GPG_ERR_CARD_NOT_PRESENT
-      || gpg_err_code (err) == GPG_ERR_ENODEV)
-    goto leave;
-
   /* Figure out the application to use.  */
   if (want_undefined)
     {
       /* We switch to the "undefined" application only if explicitly
          requested.  */
       app->apptype = "UNDEFINED";
+      /* Clear the error so that we don't run through the application
+       * selection chain.  */
       err = 0;
     }
   else
-    err = gpg_error (GPG_ERR_NOT_FOUND);
+    {
+      /* For certain error codes, there is no need to try more.  */
+      if (gpg_err_code (err) == GPG_ERR_CARD_NOT_PRESENT
+          || gpg_err_code (err) == GPG_ERR_ENODEV)
+        goto leave;
+
+      /* Set a default error so that we run through the application
+       * selecion chain.  */
+      err = gpg_error (GPG_ERR_NOT_FOUND);
+    }
 
   if (err && is_app_allowed ("openpgp")
           && (!name || !strcmp (name, "openpgp")))

-----------------------------------------------------------------------

Summary of changes:
 scd/app.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Jan 26 23:11:06 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Sat, 26 Jan 2019 23:11:06 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-332-gec13b1c
Message-ID: <E1gnWAO-000567-Tz@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ec13b1c562e34c0fcbc7b848ab6dc187b79cf2c1 (commit)
      from  0415b80227c52620bece3ae7502f38f24a23e59d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ec13b1c562e34c0fcbc7b848ab6dc187b79cf2c1
Author: Werner Koch <wk at gnupg.org>
Date:   Sat Jan 26 23:10:38 2019 +0100

    gpg: Move S2K encoding function to a shared file.
    
    * g10/passphrase.c (encode_s2k_iterations): Move function to ...
    * common/openpgp-s2k.c: new file.  Remove default intialization code.
    * common/openpgpdefs.h (S2K_DECODE_COUNT): New to keep only one copy.
    * g10/call-agent.c (agent_get_s2k_count): Change to return the count
    and print an error.
    * agent/protect.c: Include openpgpdefs.h
    * g10/card-util.c (gen_kdf_data): Adjust for changes
    * g10/gpgcompose.c: Include call-agent.h.
    (sk_esk): Adjust for changes.
    * g10/passphrase (passphrase_to_dek): Adjust for changes.
    * g10/main.h (S2K_DECODE_COUNT): Remove macro.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/protect.c b/agent/protect.c
index f95527f..eda247f 100644
--- a/agent/protect.c
+++ b/agent/protect.c
@@ -41,6 +41,7 @@
 
 #include "cvt-openpgp.h"
 #include "../common/sexp-parse.h"
+#include "../common/openpgpdefs.h"  /* For s2k functions.  */
 
 
 /* The protection mode for encryption.  The supported modes for
@@ -49,9 +50,6 @@
 #define PROT_CIPHER_STRING "aes"
 #define PROT_CIPHER_KEYLEN (128/8)
 
-/* Decode an rfc4880 encoded S2K count.  */
-#define S2K_DECODE_COUNT(_val) ((16ul + ((_val) & 15)) << (((_val) >> 4) + 6))
-
 
 /* A table containing the information needed to create a protected
    private key.  */
diff --git a/common/Makefile.am b/common/Makefile.am
index d288fa3..b6a6605 100644
--- a/common/Makefile.am
+++ b/common/Makefile.am
@@ -83,7 +83,7 @@ common_sources = \
 	localename.c \
 	session-env.c session-env.h \
 	userids.c userids.h \
-	openpgp-oid.c \
+	openpgp-oid.c openpgp-s2k.c \
 	ssh-utils.c ssh-utils.h \
 	agent-opt.c \
 	helpfile.c \
diff --git a/common/openpgp-s2k.c b/common/openpgp-s2k.c
new file mode 100644
index 0000000..2b0ba60
--- /dev/null
+++ b/common/openpgp-s2k.c
@@ -0,0 +1,67 @@
+/* openpgp-s2ks.c - OpenPGP S2K helper functions
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004,
+ *               2005, 2006 Free Software Foundation, Inc.
+ * Copyright (C) 2010, 2019 g10 Code GmbH
+ *
+ * This file is part of GnuPG.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of either
+ *
+ *   - the GNU Lesser General Public License as published by the Free
+ *     Software Foundation; either version 3 of the License, or (at
+ *     your option) any later version.
+ *
+ * or
+ *
+ *   - the GNU General Public License as published by the Free
+ *     Software Foundation; either version 2 of the License, or (at
+ *     your option) any later version.
+ *
+ * or both in parallel, as here.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <ctype.h>
+#include <assert.h>
+
+#include "util.h"
+#include "openpgpdefs.h"
+
+
+/* Pack an s2k iteration count into the form specified in RFC-48800.
+ * If we're in between valid values, round up.  */
+unsigned char
+encode_s2k_iterations (int iterations)
+{
+  unsigned char c=0;
+  unsigned char result;
+  unsigned int count;
+
+  if (iterations <= 1024)
+    return 0;  /* Command line arg compatibility.  */
+
+  if (iterations >= 65011712)
+    return 255;
+
+  /* Need count to be in the range 16-31 */
+  for (count=iterations>>6; count>=32; count>>=1)
+    c++;
+
+  result = (c<<4)|(count-16);
+
+  if (S2K_DECODE_COUNT(result) < iterations)
+    result++;
+
+  return result;
+}
diff --git a/common/openpgpdefs.h b/common/openpgpdefs.h
index 8699a17..aadda43 100644
--- a/common/openpgpdefs.h
+++ b/common/openpgpdefs.h
@@ -197,4 +197,14 @@ typedef enum
 compress_algo_t;
 
 
+
+
+/* Decode an rfc4880 encoded S2K count.  */
+#define S2K_DECODE_COUNT(_val) ((16ul + ((_val) & 15)) << (((_val) >> 4) + 6))
+
+
+/*--openpgp-s2k.c --*/
+unsigned char encode_s2k_iterations (int iterations);
+
+
 #endif /*GNUPG_COMMON_OPENPGPDEFS_H*/
diff --git a/common/ttyio.c b/common/ttyio.c
index c7c9d85..374b9f3 100644
--- a/common/ttyio.c
+++ b/common/ttyio.c
@@ -564,6 +564,8 @@ do_get( const char *prompt, int hidden )
 }
 
 
+
+/* Note: This function never returns NULL. */
 char *
 tty_get( const char *prompt )
 {
diff --git a/g10/call-agent.c b/g10/call-agent.c
index c958b84..91af2be 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -1461,19 +1461,19 @@ gpg_agent_get_confirmation (const char *desc)
 }
 
 
-/* Return the S2K iteration count as computed by gpg-agent.  */
-gpg_error_t
-agent_get_s2k_count (unsigned long *r_count)
+/* Return the S2K iteration count as computed by gpg-agent.  On error
+ * print a warning and return a default value. */
+unsigned long
+agent_get_s2k_count (void)
 {
   gpg_error_t err;
   membuf_t data;
   char *buf;
-
-  *r_count = 0;
+  unsigned long count = 0;
 
   err = start_agent (NULL, 0);
   if (err)
-    return err;
+    goto leave;
 
   init_membuf (&data, 32);
   err = assuan_transact (agent_ctx, "GETINFO s2k_count",
@@ -1489,10 +1489,22 @@ agent_get_s2k_count (unsigned long *r_count)
         err = gpg_error_from_syserror ();
       else
         {
-          *r_count = strtoul (buf, NULL, 10);
+          count = strtoul (buf, NULL, 10);
           xfree (buf);
         }
     }
+
+ leave:
+  if (err || count < 65536)
+    {
+      /* Don't print an error if an older agent is used.  */
+      if (err && gpg_err_code (err) != GPG_ERR_ASS_PARAMETER)
+        log_error (_("problem with the agent: %s\n"), gpg_strerror (err));
+
+      /* Default to 65536 which was used up to 2.0.13.  */
+      return 65536;
+    }
+
   return err;
 }
 
diff --git a/g10/call-agent.h b/g10/call-agent.h
index 8ea8ffe..8619a34 100644
--- a/g10/call-agent.h
+++ b/g10/call-agent.h
@@ -146,7 +146,7 @@ gpg_error_t agent_clear_passphrase (const char *cache_id);
 gpg_error_t gpg_agent_get_confirmation (const char *desc);
 
 /* Return the S2K iteration count as computed by gpg-agent.  */
-gpg_error_t agent_get_s2k_count (unsigned long *r_count);
+unsigned long agent_get_s2k_count (void);
 
 /* Check whether a secret key for public key PK is available.  Returns
    0 if the secret key is available. */
diff --git a/g10/card-util.c b/g10/card-util.c
index eca2484..08844ba 100644
--- a/g10/card-util.c
+++ b/g10/card-util.c
@@ -2039,7 +2039,7 @@ gen_kdf_data (unsigned char *data, int single_salt)
 
   p = data;
 
-  s2k_char = encode_s2k_iterations (0);
+  s2k_char = encode_s2k_iterations (agent_get_s2k_count ());
   iterations = S2K_DECODE_COUNT (s2k_char);
   count_4byte[0] = (iterations >> 24) & 0xff;
   count_4byte[1] = (iterations >> 16) & 0xff;
diff --git a/g10/gpgcompose.c b/g10/gpgcompose.c
index 6f573ce..5c08575 100644
--- a/g10/gpgcompose.c
+++ b/g10/gpgcompose.c
@@ -25,6 +25,7 @@
 #include "keydb.h"
 #include "main.h"
 #include "options.h"
+#include "call-agent.h"
 
 static int do_debug;
 #define debug(fmt, ...) \
@@ -2248,9 +2249,12 @@ sk_esk (const char *option, int argc, char *argv[], void *cookie)
   log_assert (sizeof (si.salt) == sizeof (ske->s2k.salt));
   memcpy (ske->s2k.salt, si.salt, sizeof (ske->s2k.salt));
   if (! si.s2k_is_session_key)
-    /* 0 means get the default.  */
-    ske->s2k.count = encode_s2k_iterations (si.iterations);
-
+    {
+      if (!si.iterations)
+        ske->s2k.count = encode_s2k_iterations (agent_get_s2k_count ());
+      else
+        ske->s2k.count = encode_s2k_iterations (si.iterations);
+    }
 
   /* Derive the symmetric key that is either the session key or the
      key used to encrypt the session key.  */
diff --git a/g10/keydb.h b/g10/keydb.h
index 1def2bb..acb4244 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -276,7 +276,6 @@ gpg_error_t build_sk_list (ctrl_t ctrl, strlist_t locusr,
                            SK_LIST *ret_sk_list, unsigned use);
 
 /*-- passphrase.h --*/
-unsigned char encode_s2k_iterations (int iterations);
 int  have_static_passphrase(void);
 const char *get_static_passphrase (void);
 void set_passphrase_from_string(const char *pass);
diff --git a/g10/main.h b/g10/main.h
index 86f8589..867f697 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -507,8 +507,6 @@ gpg_error_t  card_generate_subkey (ctrl_t ctrl, kbnode_t pub_keyblock);
 int  card_store_subkey (KBNODE node, int use);
 #endif
 
-#define S2K_DECODE_COUNT(_val) ((16ul + ((_val) & 15)) << (((_val) >> 4) + 6))
-
 /*-- migrate.c --*/
 void migrate_secring (ctrl_t ctrl);
 
diff --git a/g10/passphrase.c b/g10/passphrase.c
index 10574ec..99a2c0d 100644
--- a/g10/passphrase.c
+++ b/g10/passphrase.c
@@ -48,57 +48,6 @@ static char *next_pw = NULL;
 static char *last_pw = NULL;
 
 
-
-/* Pack an s2k iteration count into the form specified in 2440.  If
-   we're in between valid values, round up.  With value 0 return the
-   old default.  */
-unsigned char
-encode_s2k_iterations (int iterations)
-{
-  gpg_error_t err;
-  unsigned char c=0;
-  unsigned char result;
-  unsigned int count;
-
-  if (!iterations)
-    {
-      unsigned long mycnt;
-
-      /* Ask the gpg-agent for a useful iteration count.  */
-      err = agent_get_s2k_count (&mycnt);
-      if (err || mycnt < 65536)
-        {
-          /* Don't print an error if an older agent is used.  */
-          if (err && gpg_err_code (err) != GPG_ERR_ASS_PARAMETER)
-            log_error (_("problem with the agent: %s\n"), gpg_strerror (err));
-          /* Default to 65536 which we used up to 2.0.13.  */
-          return 96;
-        }
-      else if (mycnt >= 65011712)
-        return 255; /* Largest possible value.  */
-      else
-        return encode_s2k_iterations ((int)mycnt);
-    }
-
-  if (iterations <= 1024)
-    return 0;  /* Command line arg compatibility.  */
-
-  if (iterations >= 65011712)
-    return 255;
-
-  /* Need count to be in the range 16-31 */
-  for (count=iterations>>6; count>=32; count>>=1)
-    c++;
-
-  result = (c<<4)|(count-16);
-
-  if (S2K_DECODE_COUNT(result) < iterations)
-    result++;
-
-  return result;
-}
-
-
 int
 have_static_passphrase()
 {
@@ -106,6 +55,7 @@ have_static_passphrase()
           && (opt.batch || opt.pinentry_mode == PINENTRY_MODE_LOOPBACK));
 }
 
+
 /* Return a static passphrase.  The returned value is only valid as
    long as no other passphrase related function is called.  NULL may
    be returned if no passphrase has been set; better use
@@ -342,7 +292,7 @@ passphrase_to_dek (int cipher_algo, STRING2KEY *s2k,
              call out to gpg-agent and that should not be done during
              option processing in main().  */
           if (!opt.s2k_count)
-            opt.s2k_count = encode_s2k_iterations (0);
+            opt.s2k_count = encode_s2k_iterations (agent_get_s2k_count ());
           s2k->count = opt.s2k_count;
         }
     }

-----------------------------------------------------------------------

Summary of changes:
 agent/protect.c                       |  4 +--
 common/Makefile.am                    |  2 +-
 common/{xasprintf.c => openpgp-s2k.c} | 59 +++++++++++++++++------------------
 common/openpgpdefs.h                  | 10 ++++++
 common/ttyio.c                        |  2 ++
 g10/call-agent.c                      | 26 ++++++++++-----
 g10/call-agent.h                      |  2 +-
 g10/card-util.c                       |  2 +-
 g10/gpgcompose.c                      | 10 ++++--
 g10/keydb.h                           |  1 -
 g10/main.h                            |  2 --
 g10/passphrase.c                      | 54 ++------------------------------
 12 files changed, 72 insertions(+), 102 deletions(-)
 copy common/{xasprintf.c => openpgp-s2k.c} (53%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Jan 26 23:18:05 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Sat, 26 Jan 2019 23:18:05 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-333-g54f88af
Message-ID: <E1gnWH8-0005V7-SI@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  54f88afba4564e62e51fe6e22beabbdee75f91ac (commit)
      from  ec13b1c562e34c0fcbc7b848ab6dc187b79cf2c1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 54f88afba4564e62e51fe6e22beabbdee75f91ac
Author: Werner Koch <wk at gnupg.org>
Date:   Sat Jan 26 23:17:54 2019 +0100

    gpg: Fix just changed agent_get_s2k_count.
    
    * g10/call-agent.c (agent_get_s2k_count): Actually return the count.
    --
    
    The previous push was definitely a bit to hasty.
    Fixes-Commit: ec13b1c562e34c0fcbc7b848ab6dc187b79cf2c1
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/call-agent.c b/g10/call-agent.c
index 91af2be..8377753 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -1502,10 +1502,10 @@ agent_get_s2k_count (void)
         log_error (_("problem with the agent: %s\n"), gpg_strerror (err));
 
       /* Default to 65536 which was used up to 2.0.13.  */
-      return 65536;
+      count = 65536;
     }
 
-  return err;
+  return count;
 }
 
 

-----------------------------------------------------------------------

Summary of changes:
 g10/call-agent.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sun Jan 27 05:00:10 2019
From: cvs at cvs.gnupg.org (by Ben McGinnes)
Date: Sun, 27 Jan 2019 05:00:10 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-126-g1e26572
Message-ID: <E1gnbcB-0005lY-EU@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  1e265723653042bc1010b457537b69a2011b43b7 (commit)
      from  ed81892917f47dddc23aa99d88733e3f8f344256 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1e265723653042bc1010b457537b69a2011b43b7
Author: Ben McGinnes <ben at adversary.org>
Date:   Sun Jan 27 14:57:53 2019 +1100

    python: post installer docs fix script
    
    * Moved post_installer.py into the examples/howto/ directory.
    * Added instructions for its use to the Python Bindings HOWTO.
    * Ran it as intended from the lang/python/ directory in order to both
      prove it works and quickly and easily get the updated howto
      replicated.  Also to fix all those .texi files.
    
    Tested-by: Ben McGinnes <ben at adversary.org>
    Signed-off-by: Ben McGinnes <ben at adversary.org>

diff --git a/lang/python/doc/rst/gpgme-python-howto.rst b/lang/python/doc/rst/gpgme-python-howto.rst
index 4146e37..5f8bcd5 100644
--- a/lang/python/doc/rst/gpgme-python-howto.rst
+++ b/lang/python/doc/rst/gpgme-python-howto.rst
@@ -683,6 +683,21 @@ on the system and version of Python in use. Another option is to run the
 command ``python3 -m virtualenv /path/to/install/virtual/thingy``
 instead.
 
+.. _snafu-docs:
+
+Post installation
+~~~~~~~~~~~~~~~~~
+
+Following installation it is recommended to move the
+``post_installer.py`` script from the ``lang/python/examples/howto/``
+directory to the ``lang/python/`` directory and run it. This will fix or
+restore files needed by Sphinx which may be removed during a
+distribution build for release. It will also generate reST files from
+Org mode files with Pandoc and generate Texinfo files from Org mode
+files with GNU Emacs and Org mode (in batch mode). Additionally it will
+fix the UTF-8 declaration line in the Texinfo files (Emacs expects
+\"UTF-8\" to be \"utf-8\").
+
 .. _howto-fund-a-mental:
 
 Fundamentals
diff --git a/lang/python/doc/rst/index.rst b/lang/python/doc/rst/index.rst
index 9c4f0f7..3ff34fc 100644
--- a/lang/python/doc/rst/index.rst
+++ b/lang/python/doc/rst/index.rst
@@ -7,7 +7,7 @@ GPGME Python Bindings
 =====================
 
 .. toctree::
-   :maxdepth: 2
+   :maxdepth: 3
    :caption: Contents:
 
 Contents
@@ -20,11 +20,3 @@ Contents
 
 -  `What Was New <what-was-new>`__
 -  `GPGME Python Bindings HOWTO <gpgme-python-howto>`__
-
-
-Indices and tables
-==================
-
-* :ref:`genindex`
-* :ref:`modindex`
-* :ref:`search`
diff --git a/lang/python/doc/src/gpgme-python-howto b/lang/python/doc/src/gpgme-python-howto
index 6569806..c63191b 100644
--- a/lang/python/doc/src/gpgme-python-howto
+++ b/lang/python/doc/src/gpgme-python-howto
@@ -705,6 +705,22 @@ the command =python3 -m virtualenv /path/to/install/virtual/thingy=
 instead.
 
 
+*** Post installation
+    :PROPERTIES:
+    :CUSTOM_ID: snafu-docs
+    :END:
+
+Following installation it is recommended to move the
+=post_installer.py= script from the =lang/python/examples/howto/=
+directory to the =lang/python/= directory and run it.  This will fix
+or restore files needed by Sphinx which may be removed during a
+distribution build for release.  It will also generate reST files from
+Org mode files with Pandoc and generate Texinfo files from Org mode
+files with GNU Emacs and Org mode (in batch mode).  Additionally it
+will fix the UTF-8 declaration line in the Texinfo files (Emacs
+expects "UTF-8" to be "utf-8").
+
+
 * Fundamentals
   :PROPERTIES:
   :CUSTOM_ID: howto-fund-a-mental
diff --git a/lang/python/doc/texinfo/gpgme-python-howto.texi b/lang/python/doc/texinfo/gpgme-python-howto.texi
index fac0056..9f53aa5 100644
--- a/lang/python/doc/texinfo/gpgme-python-howto.texi
+++ b/lang/python/doc/texinfo/gpgme-python-howto.texi
@@ -81,6 +81,7 @@ Known Issues
 * Won't Work With Windows::
 * CFFI is the Best? and GPGME should use it instead of SWIG::
 * Virtualised Environments::
+* Post installation::
 
 Fundamentals
 
@@ -511,6 +512,7 @@ they be encountered.
 * Won't Work With Windows::
 * CFFI is the Best? and GPGME should use it instead of SWIG::
 * Virtualised Environments::
+* Post installation::
 @end menu
 
 @node Breaking Builds
@@ -883,6 +885,19 @@ on the system and version of Python in use.  Another option is to run
 the command @samp{python3 -m virtualenv /path/to/install/virtual/thingy}
 instead.
 
+ at node Post installation
+ at subsection Post installation
+
+Following installation it is recommended to move the
+ at samp{post_installer.py} script from the @samp{lang/python/examples/howto/}
+directory to the @samp{lang/python/} directory and run it.  This will fix
+or restore files needed by Sphinx which may be removed during a
+distribution build for release.  It will also generate reST files from
+Org mode files with Pandoc and generate Texinfo files from Org mode
+files with GNU Emacs and Org mode (in batch mode).  Additionally it
+will fix the UTF-8 declaration line in the Texinfo files (Emacs
+expects "UTF-8" to be "utf-8").
+
 @node Fundamentals
 @chapter Fundamentals
 
@@ -3465,4 +3480,4 @@ WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
 implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
 PURPOSE.
 
- at bye
+ at bye
\ No newline at end of file
diff --git a/lang/python/doc/texinfo/index.texi b/lang/python/doc/texinfo/index.texi
index 0f4863c..95c27c2 100644
--- a/lang/python/doc/texinfo/index.texi
+++ b/lang/python/doc/texinfo/index.texi
@@ -57,4 +57,4 @@ GPGME Python Bindings
 @uref{gpgme-python-howto, GPGME Python Bindings HOWTO}
 @end itemize
 
- at bye
+ at bye
\ No newline at end of file
diff --git a/lang/python/doc/texinfo/maintenance-mode.texi b/lang/python/doc/texinfo/maintenance-mode.texi
index d38875b..9245719 100644
--- a/lang/python/doc/texinfo/maintenance-mode.texi
+++ b/lang/python/doc/texinfo/maintenance-mode.texi
@@ -166,4 +166,4 @@ already be done when converting Org to reStructuredText or Org to
 Texinfo.  As a certain amount of work would be required to get it
 done, there would need to be clear demand for that work to be done.
 
- at bye
+ at bye
\ No newline at end of file
diff --git a/lang/python/doc/texinfo/short-history.texi b/lang/python/doc/texinfo/short-history.texi
index cbb13f3..d27f68d 100644
--- a/lang/python/doc/texinfo/short-history.texi
+++ b/lang/python/doc/texinfo/short-history.texi
@@ -221,4 +221,4 @@ For those using Python 2, there is essentially no harm in using
 this module, but it may lack a number of more recent features
 added to GPGME.
 
- at bye
+ at bye
\ No newline at end of file
diff --git a/lang/python/doc/texinfo/what-is-new.texi b/lang/python/doc/texinfo/what-is-new.texi
index 5abc87a..406ab2f 100644
--- a/lang/python/doc/texinfo/what-is-new.texi
+++ b/lang/python/doc/texinfo/what-is-new.texi
@@ -91,4 +91,4 @@ repetition if a key includes a user ID matching the hexadecimal
 value of a key ID.
 @end itemize
 
- at bye
+ at bye
\ No newline at end of file
diff --git a/lang/python/doc/texinfo/what-was-new.texi b/lang/python/doc/texinfo/what-was-new.texi
index 29ea847..3f0ad9d 100644
--- a/lang/python/doc/texinfo/what-was-new.texi
+++ b/lang/python/doc/texinfo/what-was-new.texi
@@ -157,4 +157,4 @@ the time).
 Cleaned up a lot of things under the hood.
 @end itemize
 
- at bye
+ at bye
\ No newline at end of file
diff --git a/lang/python/post_installer.py b/lang/python/examples/howto/post_installer.py
similarity index 100%
rename from lang/python/post_installer.py
rename to lang/python/examples/howto/post_installer.py

-----------------------------------------------------------------------

Summary of changes:
 lang/python/doc/rst/gpgme-python-howto.rst         | 15 +++++++++++++++
 lang/python/doc/rst/index.rst                      | 10 +---------
 lang/python/doc/src/gpgme-python-howto             | 16 ++++++++++++++++
 lang/python/doc/texinfo/gpgme-python-howto.texi    | 17 ++++++++++++++++-
 lang/python/doc/texinfo/index.texi                 |  2 +-
 lang/python/doc/texinfo/maintenance-mode.texi      |  2 +-
 lang/python/doc/texinfo/short-history.texi         |  2 +-
 lang/python/doc/texinfo/what-is-new.texi           |  2 +-
 lang/python/doc/texinfo/what-was-new.texi          |  2 +-
 lang/python/{ => examples/howto}/post_installer.py |  0
 10 files changed, 53 insertions(+), 15 deletions(-)
 rename lang/python/{ => examples/howto}/post_installer.py (100%)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sun Jan 27 06:05:14 2019
From: cvs at cvs.gnupg.org (by Ben McGinnes)
Date: Sun, 27 Jan 2019 06:05:14 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-127-g2de1e59
Message-ID: <E1gncd9-0004fe-AT@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  2de1e599770cdb129b84302d963f65fdd3ddd2a4 (commit)
      from  1e265723653042bc1010b457537b69a2011b43b7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2de1e599770cdb129b84302d963f65fdd3ddd2a4
Author: Ben McGinnes <ben at adversary.org>
Date:   Sun Jan 27 16:02:24 2019 +1100

    python: post installer script
    
    * Removed auto-generated .texi files from doc/src/ so only the
      corrected versions are left.
    * Which means now it is complete, but with the initial work to expand
      it with info file generation later.

diff --git a/lang/python/examples/howto/post_installer.py b/lang/python/examples/howto/post_installer.py
index b9fd36f..b493f97 100755
--- a/lang/python/examples/howto/post_installer.py
+++ b/lang/python/examples/howto/post_installer.py
@@ -136,6 +136,10 @@ for ipath in info_paths:
     else:
         pass
 
+# Remove the old generated .texi files from the org source directory.
+for texifile in doctexi2:
+    os.remove(texifile)
+
 print("""
 You may now build your preferred documentation format using either:
 

-----------------------------------------------------------------------

Summary of changes:
 lang/python/examples/howto/post_installer.py | 4 ++++
 1 file changed, 4 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sun Jan 27 12:05:30 2019
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Sun, 27 Jan 2019 12:05:30 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.1-151-gafab94d
Message-ID: <E1gniFn-0003iy-LN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  afab94d222425ecb838eb56cb0723bdaf3e5de36 (commit)
      from  c15409c49993166ab1325d45360b3a8fe72a5556 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit afab94d222425ecb838eb56cb0723bdaf3e5de36
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sun Jan 27 12:55:22 2019 +0200

    Do not precalculate OCB offset L0+L1+L0
    
    * cipher/cipher-internal.h (gcry_cipher_handle): Remove OCB L0L1L0.
    * cipher/cipher-ocb.c (_gcry_cipher_ocb_setkey): Ditto.
    * cipher/rijndael-aesni.c (aesni_ocb_enc, aesni_ocb_dec)
    (_gcry_aes_aesni_ocb_auth): Replace L0L1L0 use with L1.
    --
    
    Patch fixes L0+L1+L0 thinko. This is same as L1 (L0 xor L1 xor L0).
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/cipher-internal.h b/cipher/cipher-internal.h
index 79de140..5ece774 100644
--- a/cipher/cipher-internal.h
+++ b/cipher/cipher-internal.h
@@ -322,7 +322,6 @@ struct gcry_cipher_handle
       unsigned char L_star[OCB_BLOCK_LEN];
       unsigned char L_dollar[OCB_BLOCK_LEN];
       unsigned char L0L1[OCB_BLOCK_LEN];
-      unsigned char L0L1L0[OCB_BLOCK_LEN];
       unsigned char L[OCB_L_TABLE_SIZE][OCB_BLOCK_LEN];
 
       /* --- Following members are cleared in gcry_cipher_reset --- */
diff --git a/cipher/cipher-ocb.c b/cipher/cipher-ocb.c
index be6b8df..308b049 100644
--- a/cipher/cipher-ocb.c
+++ b/cipher/cipher-ocb.c
@@ -141,11 +141,9 @@ void _gcry_cipher_ocb_setkey (gcry_cipher_hd_t c)
   double_block_cpy (c->u_mode.ocb.L[0], c->u_mode.ocb.L_dollar);
   for (i = 1; i < OCB_L_TABLE_SIZE; i++)
     double_block_cpy (c->u_mode.ocb.L[i], c->u_mode.ocb.L[i-1]);
-  /* Precalculated offsets L0+L1, L0+L1+L0 */
+  /* Precalculated offset L0+L1 */
   cipher_block_xor (c->u_mode.ocb.L0L1,
 		    c->u_mode.ocb.L[0], c->u_mode.ocb.L[1], OCB_BLOCK_LEN);
-  cipher_block_xor (c->u_mode.ocb.L0L1L0,
-		    c->u_mode.ocb.L[0], c->u_mode.ocb.L0L1, OCB_BLOCK_LEN);
 
   /* Cleanup */
   wipememory (ktop, sizeof ktop);
diff --git a/cipher/rijndael-aesni.c b/cipher/rijndael-aesni.c
index ec9f4d4..9883861 100644
--- a/cipher/rijndael-aesni.c
+++ b/cipher/rijndael-aesni.c
@@ -2429,11 +2429,11 @@ aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
 	  l = aes_ocb_get_l(c, n);
 
 	  asm volatile ("movdqu %[l0l1],   %%xmm10\n\t"
-			"movdqu %[l0l1l0], %%xmm11\n\t"
+			"movdqu %[l1],     %%xmm11\n\t"
 			"movdqu %[l3],     %%xmm15\n\t"
 			:
 			: [l0l1] "m" (*c->u_mode.ocb.L0L1),
-			  [l0l1l0] "m" (*c->u_mode.ocb.L0L1L0),
+			  [l1] "m" (*c->u_mode.ocb.L[1]),
 			  [l3] "m" (*l)
 			: "memory" );
 
@@ -2561,13 +2561,13 @@ aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
 		      [l0l1] "m" (*c->u_mode.ocb.L0L1),
 		      [inbuf0] "m" (*(inbuf + 0 * BLOCKSIZE))
 		    : "memory" );
-      asm volatile ("movdqu %[l0l1l0], %%xmm4\n\t"
+      asm volatile ("movdqu %[l1],     %%xmm4\n\t"
 		    "movdqu %[l3],     %%xmm6\n\t"
 		    "pxor   %%xmm5,    %%xmm0\n\t"
 		    "pxor   %%xmm0,    %%xmm1\n\t"
 		    "movdqu %%xmm0,    %[outbuf0]\n\t"
 		    : [outbuf0] "=m" (*(outbuf + 0 * BLOCKSIZE))
-		    : [l0l1l0] "m" (*c->u_mode.ocb.L0L1L0),
+		    : [l1] "m" (*c->u_mode.ocb.L[1]),
 		      [l3] "m" (*l)
 		    : "memory" );
       asm volatile ("movdqu %[inbuf1], %%xmm2\n\t"
@@ -2730,11 +2730,11 @@ aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
 	  l = aes_ocb_get_l(c, n);
 
 	  asm volatile ("movdqu %[l0l1],   %%xmm10\n\t"
-			"movdqu %[l0l1l0], %%xmm11\n\t"
+			"movdqu %[l1],     %%xmm11\n\t"
 			"movdqu %[l3],     %%xmm15\n\t"
 			:
 			: [l0l1] "m" (*c->u_mode.ocb.L0L1),
-			  [l0l1l0] "m" (*c->u_mode.ocb.L0L1L0),
+			  [l1] "m" (*c->u_mode.ocb.L[1]),
 			  [l3] "m" (*l)
 			: "memory" );
 
@@ -2862,13 +2862,13 @@ aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
 		      [l0l1] "m" (*c->u_mode.ocb.L0L1),
 		      [inbuf0] "m" (*(inbuf + 0 * BLOCKSIZE))
 		    : "memory" );
-      asm volatile ("movdqu %[l0l1l0], %%xmm4\n\t"
+      asm volatile ("movdqu %[l1],     %%xmm4\n\t"
 		    "movdqu %[l3],     %%xmm6\n\t"
 		    "pxor   %%xmm5,    %%xmm0\n\t"
 		    "pxor   %%xmm0,    %%xmm1\n\t"
 		    "movdqu %%xmm0,    %[outbuf0]\n\t"
 		    : [outbuf0] "=m" (*(outbuf + 0 * BLOCKSIZE))
-		    : [l0l1l0] "m" (*c->u_mode.ocb.L0L1L0),
+		    : [l1] "m" (*c->u_mode.ocb.L[1]),
 		      [l3] "m" (*l)
 		    : "memory" );
       asm volatile ("movdqu %[inbuf1], %%xmm2\n\t"
@@ -3028,11 +3028,11 @@ _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 
       asm volatile ("movdqu %[l0],     %%xmm7\n\t"
 		    "movdqu %[l0l1],   %%xmm12\n\t"
-		    "movdqu %[l0l1l0], %%xmm13\n\t"
+		    "movdqu %[l1],     %%xmm13\n\t"
 		    :
 		    : [l0] "m" (*c->u_mode.ocb.L[0]),
 		      [l0l1] "m" (*c->u_mode.ocb.L0L1),
-		      [l0l1l0] "m" (*c->u_mode.ocb.L0L1L0)
+		      [l1] "m" (*c->u_mode.ocb.L[1])
 		    : "memory" );
 
       for ( ;nblocks >= 8 ; nblocks -= 8 )
@@ -3138,12 +3138,12 @@ _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 		      [l0l1] "m" (*c->u_mode.ocb.L0L1),
 		      [abuf0] "m" (*(abuf + 0 * BLOCKSIZE))
 		    : "memory" );
-      asm volatile ("movdqu %[l0l1l0], %%xmm4\n\t"
+      asm volatile ("movdqu %[l1],     %%xmm4\n\t"
 		    "movdqu %[l3],     %%xmm7\n\t"
 		    "pxor   %%xmm5,    %%xmm0\n\t"
 		    "pxor   %%xmm0,    %%xmm1\n\t"
 		    :
-		    : [l0l1l0] "m" (*c->u_mode.ocb.L0L1L0),
+		    : [l1] "m" (*c->u_mode.ocb.L[1]),
 		      [l3] "m" (*l)
 		    : "memory" );
       asm volatile ("movdqu %[abuf1],  %%xmm2\n\t"

-----------------------------------------------------------------------

Summary of changes:
 cipher/cipher-internal.h |  1 -
 cipher/cipher-ocb.c      |  4 +---
 cipher/rijndael-aesni.c  | 24 ++++++++++++------------
 3 files changed, 13 insertions(+), 16 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 28 05:03:48 2019
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 28 Jan 2019 05:03:48 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-335-g02a2633
Message-ID: <E1gny9F-0008WN-U4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  02a2633a7f0b7d91aa48ea615fb3a0edfd6ed6bb (commit)
      from  1c9251004592415b27988064ae20504dd1c37f57 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 02a2633a7f0b7d91aa48ea615fb3a0edfd6ed6bb
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 28 12:58:13 2019 +0900

    agent: Clear bogus pinentry cache, when it causes an error.
    
    * agent/agent.h (PINENTRY_STATUS_*): Expose to public.
    (struct pin_entry_info_s): Add status.
    * agent/call-pinentry.c (agent_askpin): Clearing the ->status
    before the loop, let the assuan_transact set ->status.  When
    failure with PINENTRY_STATUS_PASSWORD_FROM_CACHE, it returns
    soon.
    * agent/findkey.c (unprotect): Clear the pinentry cache,
    when it causes an error.
    
    --
    
    GnuPG-bug-id: 4348
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/agent/agent.h b/agent/agent.h
index 05080f1..ee5a31e 100644
--- a/agent/agent.h
+++ b/agent/agent.h
@@ -266,6 +266,14 @@ struct server_control_s
 };
 
 
+/* Status of pinentry.  */
+enum
+  {
+    PINENTRY_STATUS_CLOSE_BUTTON = 1 << 0,
+    PINENTRY_STATUS_PIN_REPEATED = 1 << 8,
+    PINENTRY_STATUS_PASSWORD_FROM_CACHE = 1 << 9
+  };
+
 /* Information pertaining to pinentry requests.  */
 struct pin_entry_info_s
 {
@@ -275,7 +283,8 @@ struct pin_entry_info_s
   int failed_tries; /* Number of tries so far failed.  */
   int with_qualitybar; /* Set if the quality bar should be displayed.  */
   int with_repeat;  /* Request repetition of the passphrase.  */
-  int repeat_okay;  /* Repetition worked. */
+  int repeat_okay;  /* Repetition worked.  */
+  unsigned int status; /* Status.  */
   gpg_error_t (*check_cb)(struct pin_entry_info_s *); /* CB used to check
                                                          the PIN */
   void *check_cb_arg;  /* optional argument which might be of use in the CB */
diff --git a/agent/call-pinentry.c b/agent/call-pinentry.c
index 38c01e2..541a4a3 100644
--- a/agent/call-pinentry.c
+++ b/agent/call-pinentry.c
@@ -894,13 +894,6 @@ setup_qualitybar (ctrl_t ctrl)
   return 0;
 }
 
-enum
-  {
-    PINENTRY_STATUS_CLOSE_BUTTON = 1 << 0,
-    PINENTRY_STATUS_PIN_REPEATED = 1 << 8,
-    PINENTRY_STATUS_PASSWORD_FROM_CACHE = 1 << 9
-  };
-
 /* Check the button_info line for a close action.  Also check for the
    PIN_REPEATED flag.  */
 static gpg_error_t
@@ -965,7 +958,6 @@ agent_askpin (ctrl_t ctrl,
   const char *errtext = NULL;
   int is_pin = 0;
   int saveflag;
-  unsigned int pinentry_status;
 
   if (opt.batch)
     return 0; /* fixme: we should return BAD PIN */
@@ -1076,6 +1068,7 @@ agent_askpin (ctrl_t ctrl,
         pininfo->with_repeat = 0; /* Pinentry does not support it.  */
     }
   pininfo->repeat_okay = 0;
+  pininfo->status = 0;
 
   for (;pininfo->failed_tries < pininfo->max_tries; pininfo->failed_tries++)
     {
@@ -1109,10 +1102,9 @@ agent_askpin (ctrl_t ctrl,
 
       saveflag = assuan_get_flag (entry_ctx, ASSUAN_CONFIDENTIAL);
       assuan_begin_confidential (entry_ctx);
-      pinentry_status = 0;
       rc = assuan_transact (entry_ctx, "GETPIN", getpin_cb, &parm,
                             inq_quality, entry_ctx,
-                            pinentry_status_cb, &pinentry_status);
+                            pinentry_status_cb, &pininfo->status);
       assuan_set_flag (entry_ctx, ASSUAN_CONFIDENTIAL, saveflag);
       /* Most pinentries out in the wild return the old Assuan error code
          for canceled which gets translated to an assuan Cancel error and
@@ -1124,7 +1116,7 @@ agent_askpin (ctrl_t ctrl,
 
       /* Change error code in case the window close button was clicked
          to cancel the operation.  */
-      if ((pinentry_status & PINENTRY_STATUS_CLOSE_BUTTON)
+      if ((pininfo->status & PINENTRY_STATUS_CLOSE_BUTTON)
 	  && gpg_err_code (rc) == GPG_ERR_CANCELED)
         rc = gpg_err_make (gpg_err_source (rc), GPG_ERR_FULLY_CANCELED);
 
@@ -1151,12 +1143,19 @@ agent_askpin (ctrl_t ctrl,
           /* More checks by utilizing the optional callback. */
           pininfo->cb_errtext = NULL;
           rc = pininfo->check_cb (pininfo);
-          if (gpg_err_code (rc) == GPG_ERR_BAD_PASSPHRASE
-              && pininfo->cb_errtext)
-            errtext = pininfo->cb_errtext;
-          else if (gpg_err_code (rc) == GPG_ERR_BAD_PASSPHRASE
-                   || gpg_err_code (rc) == GPG_ERR_BAD_PIN)
-            errtext = (is_pin? L_("Bad PIN") : L_("Bad Passphrase"));
+          /* When pinentry cache causes an error, return now.  */
+          if (rc
+              && (pininfo->status & PINENTRY_STATUS_PASSWORD_FROM_CACHE))
+            return unlock_pinentry (ctrl, rc);
+
+          if (gpg_err_code (rc) == GPG_ERR_BAD_PASSPHRASE)
+            {
+              if (pininfo->cb_errtext)
+                errtext = pininfo->cb_errtext;
+              else if (gpg_err_code (rc) == GPG_ERR_BAD_PASSPHRASE
+                       || gpg_err_code (rc) == GPG_ERR_BAD_PIN)
+                errtext = (is_pin? L_("Bad PIN") : L_("Bad Passphrase"));
+            }
           else if (rc)
             return unlock_pinentry (ctrl, rc);
         }
@@ -1164,12 +1163,12 @@ agent_askpin (ctrl_t ctrl,
       if (!errtext)
         {
           if (pininfo->with_repeat
-	      && (pinentry_status & PINENTRY_STATUS_PIN_REPEATED))
+              && (pininfo->status & PINENTRY_STATUS_PIN_REPEATED))
             pininfo->repeat_okay = 1;
           return unlock_pinentry (ctrl, 0); /* okay, got a PIN or passphrase */
         }
 
-      if ((pinentry_status & PINENTRY_STATUS_PASSWORD_FROM_CACHE))
+      if ((pininfo->status & PINENTRY_STATUS_PASSWORD_FROM_CACHE))
 	/* The password was read from the cache.  Don't count this
 	   against the retry count.  */
 	pininfo->failed_tries --;
diff --git a/agent/findkey.c b/agent/findkey.c
index 78c3b1a..89a18fa 100644
--- a/agent/findkey.c
+++ b/agent/findkey.c
@@ -632,7 +632,17 @@ unprotect (ctrl_t ctrl, const char *cache_nonce, const char *desc_text,
   pi->check_cb_arg = &arg;
 
   rc = agent_askpin (ctrl, desc_text, NULL, NULL, pi, hexgrip, cache_mode);
-  if (!rc)
+  if (rc)
+    {
+      if ((pi->status & PINENTRY_STATUS_PASSWORD_FROM_CACHE))
+        {
+          log_error ("Clearing pinentry cache which caused error %s\n",
+                     gpg_strerror (rc));
+
+          agent_clear_passphrase (ctrl, hexgrip, cache_mode);
+        }
+    }
+  else
     {
       assert (arg.unprotected_key);
       if (arg.change_required)

-----------------------------------------------------------------------

Summary of changes:
 agent/agent.h         | 11 ++++++++++-
 agent/call-pinentry.c | 37 ++++++++++++++++++-------------------
 agent/findkey.c       | 12 +++++++++++-
 3 files changed, 39 insertions(+), 21 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 28 08:14:14 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 28 Jan 2019 08:14:14 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.34-4-g256c602
Message-ID: <E1go17X-0001fn-9k@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  256c602d9becd05d44a64e66e38413b2b60ca70b (commit)
       via  2421afddf6ae5a245e6dd1a59779bd26bf225253 (commit)
      from  8a9397896fd202dcfb3fb46259e43bc05a0ddd2e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 256c602d9becd05d44a64e66e38413b2b60ca70b
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 28 08:13:45 2019 +0100

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index 6c80dc3..f86b2a1 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.36 (unreleased) [C26/A26/R_]
+-----------------------------------------------
+
+
 Noteworthy changes in version 1.35 (2019-01-28) [C26/A26/R1]
 -----------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index 1a3c168..e7d10dc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -29,7 +29,7 @@ min_automake_version="1.14"
 # See below for the LT versions.
 m4_define([mym4_package],[libgpg-error])
 m4_define([mym4_major], [1])
-m4_define([mym4_minor], [35])
+m4_define([mym4_minor], [36])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit 2421afddf6ae5a245e6dd1a59779bd26bf225253
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 28 07:55:31 2019 +0100

    Release 1.35
    
    --
    
    Because gpgrt-config is not anymore generated from gpgrt-config.in and
    a stale (generated) gpgrt-config was hanging around in the build
    directory the make distcheck target didn't caught this situation and
    we accidently distributed the old gpgrt-config from the build
    directory.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index ce0ee77..6c80dc3 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
-Noteworthy changes in version 1.35 (unreleased) [C26/A26/R_]
+Noteworthy changes in version 1.35 (2019-01-28) [C26/A26/R1]
 -----------------------------------------------
 
+ * Distribute the correct gpgrt-config.
+
 
 Noteworthy changes in version 1.34 (2019-01-16) [C26/A26/R0]
 -----------------------------------------------
diff --git a/configure.ac b/configure.ac
index a7ffb5d..1a3c168 100644
--- a/configure.ac
+++ b/configure.ac
@@ -51,7 +51,7 @@ AC_INIT([mym4_package],[mym4_version], [https://bugs.gnupg.org])
 # Note that added error codes don't constitute an interface change.
 LIBGPG_ERROR_LT_CURRENT=26
 LIBGPG_ERROR_LT_AGE=26
-LIBGPG_ERROR_LT_REVISION=0
+LIBGPG_ERROR_LT_REVISION=1
 ################################################
 
 AC_SUBST(LIBGPG_ERROR_LT_CURRENT)

-----------------------------------------------------------------------

Summary of changes:
 NEWS         | 8 +++++++-
 configure.ac | 4 ++--
 2 files changed, 9 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 28 08:16:55 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 28 Jan 2019 08:16:55 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. a57e222228090e0d5399862cfc83530735a723c9
Message-ID: <E1go1A8-0001kv-SX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  a57e222228090e0d5399862cfc83530735a723c9 (commit)
      from  5d18bec60b6efff4d3b2f2e234170e80ce7bcc0a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a57e222228090e0d5399862cfc83530735a723c9
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 28 08:16:32 2019 +0100

    swdb: Release gpgrt 1.35

diff --git a/misc/id/openpgp-webkey-service/draft.org b/misc/id/openpgp-webkey-service/draft.org
index d561f7a..ae6ac09 100644
--- a/misc/id/openpgp-webkey-service/draft.org
+++ b/misc/id/openpgp-webkey-service/draft.org
@@ -523,13 +523,15 @@ To make it a bit harder to test for published keys, the server
 responsible to serve the WELLKNOWN directory SHOULD NOT create an
 index file for that directory or any sub-directory.
 
-The mail provider MUST make sure to filter a key in a way that only
-the User ID belonging to that user is returned and that confirmation
-requests are only send for such User IDs.  It is further recommended
-that a client filters the key for a publication requests so that only
-a key with the specific User ID of the provider is send.
-
-A client MUST not accept a HTTP authentication challenge (HTTP
+The mail provider MUST make sure to publish a key in a way that only
+the mail address belonging to the requested user is part of the User
+ID packets included in the returned key.  Other User ID packets and
+their associated binding signatures NUST be removed before
+publication.  Confirmation requests MUST only be send for such to be
+published User ID.  It is further recommended that a client filters a
+received key or a key send for a publication requests so that only the
+specific User ID with the mail address of the provider is imported or
+send.
 
 A client MUST NOT accept a HTTP authentication challenge (HTTP
 code 401) because the information in the Web Key Directory is public
diff --git a/web/swdb.mac b/web/swdb.mac
index 134172e..59675e3 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -136,6 +136,16 @@
 #+macro: gpgrt_size 897k
 #+macro: gpgrt_sha1 0a3e67e428a2e051a94cabd9fb140bf49fdc13d0
 #+macro: gpgrt_sha2 0680799dee71b86b2f435efb825391eb040ce2704b057f6bd3dcc47fbc398c81
+#+macro: libgpg_error_ver  1.35
+#+macro: libgpg_error_date 2019-01-28
+#+macro: libgpg_error_size 896k
+#+macro: libgpg_error_sha1 1ffc6aaac4a4eecf16132c1b4eb500c1765d7190
+#+macro: libgpg_error_sha2 cbd5ee62a8a8c88d48c158fff4fc9ead4132aacd1b4a56eb791f9f997d07e067
+#+macro: gpgrt_ver  1.35
+#+macro: gpgrt_date 2019-01-28
+#+macro: gpgrt_size 896k
+#+macro: gpgrt_sha1 1ffc6aaac4a4eecf16132c1b4eb500c1765d7190
+#+macro: gpgrt_sha2 cbd5ee62a8a8c88d48c158fff4fc9ead4132aacd1b4a56eb791f9f997d07e067
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 misc/id/openpgp-webkey-service/draft.org | 16 +++++++++-------
 web/swdb.mac                             | 10 ++++++++++
 2 files changed, 19 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 29 09:32:41 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 29 Jan 2019 09:32:41 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-337-g9325c92
Message-ID: <E1goOp2-00037A-HB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  9325c92284bb346d11c3591bb2ea88095989361a (commit)
       via  237880175f59d372011cd2e20bb49726eeccf058 (commit)
      from  02a2633a7f0b7d91aa48ea615fb3a0edfd6ed6bb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9325c92284bb346d11c3591bb2ea88095989361a
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 09:30:15 2019 +0100

    card: Print keyinfo for PIV cards.
    
    * scd/app-piv.c (do_learn_status): Print CHV-STATUS.
    * tools/card-tool.h (struct card_info_s): Rename chvretry to chvinfo.
    * tools/card-call-scd.c (learn_status_cb): Depend CHV-STATUS on app
    type.
    * tools/gpg-card-tool.c (list_piv): New.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/app-piv.c b/scd/app-piv.c
index 011b552..69f12f4 100644
--- a/scd/app-piv.c
+++ b/scd/app-piv.c
@@ -569,7 +569,7 @@ send_keypair_and_cert_info (app_t app, ctrl_t ctrl, data_object_t dobj,
 }
 
 
-/* Handle the LEARN command for OpenPGP.  */
+/* Handle the LEARN command.  */
 static gpg_error_t
 do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 {
@@ -577,10 +577,13 @@ do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 
   (void)flags;
 
+  do_getattr (app, ctrl, "CHV-STATUS");
+
   for (i=0; data_objects[i].tag; i++)
     if (data_objects[i].keypair)
       send_keypair_and_cert_info (app, ctrl, data_objects + i, !!(flags & 1));
 
+
   return 0;
 }
 
diff --git a/tools/card-call-scd.c b/tools/card-call-scd.c
index abf35ed..2551b19 100644
--- a/tools/card-call-scd.c
+++ b/tools/card-call-scd.c
@@ -808,9 +808,13 @@ learn_status_cb (void *opaque, const char *line)
 
           buf = p = unescape_status_string (line);
           if (buf)
+            while (spacep (p))
+              p++;
+
+          if (!buf)
+            ;
+          else if (parm->apptype == APP_TYPE_OPENPGP)
             {
-              while (spacep (p))
-                p++;
               parm->chv1_cached = atoi (p);
               while (*p && !spacep (p))
                 p++;
@@ -826,14 +830,26 @@ learn_status_cb (void *opaque, const char *line)
                 }
               for (i=0; *p && i < 3; i++)
                 {
-                  parm->chvretry[i] = atoi (p);
+                  parm->chvinfo[i] = atoi (p);
+                  while (*p && !spacep (p))
+                    p++;
+                  while (spacep (p))
+                    p++;
+                }
+            }
+          else if (parm->apptype == APP_TYPE_PIV)
+            {
+              for (i=0; *p && DIM (parm->chvinfo); i++)
+                {
+                  parm->chvinfo[i] = atoi (p);
                   while (*p && !spacep (p))
                     p++;
                   while (spacep (p))
                     p++;
                 }
-              xfree (buf);
             }
+
+          xfree (buf);
         }
       break;
 
diff --git a/tools/card-tool.h b/tools/card-tool.h
index 0af6186..bcc257c 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -122,12 +122,12 @@ struct card_info_s
   char cafpr3[20];
   key_info_t kinfo;  /* Linked list with all keypair related data.  */
   unsigned long sig_counter;
-  int chv1_cached;   /* True if a PIN is not required for each
-                        signing.  Note that the gpg-agent might cache
-                        it anyway. */
-  int is_v2;         /* True if this is a v2 card.  */
+  int chv1_cached;   /* For openpgp this is true if a PIN is not
+                        required for each signing.  Note that the
+                        gpg-agent might cache it anyway. */
+  int is_v2;         /* True if this is a v2 openpgp card.  */
   int chvmaxlen[3];  /* Maximum allowed length of a CHV. */
-  int chvretry[3];   /* Allowed retries for the CHV; 0 = blocked. */
+  int chvinfo[3];    /* Allowed retries for the CHV; 0 = blocked. */
   struct key_attr key_attr[3]; /* OpenPGP card key attributes.  */
   struct {
     unsigned int ki:1;     /* Key import available.  */
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index 31d9c22..5ba44fc 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -723,7 +723,7 @@ list_openpgp (card_info_t info, estream_t fp)
   tty_fprintf (fp, "Max. PIN lengths .: %d %d %d\n",
                info->chvmaxlen[0], info->chvmaxlen[1], info->chvmaxlen[2]);
   tty_fprintf (fp, "PIN retry counter : %d %d %d\n",
-               info->chvretry[0], info->chvretry[1], info->chvretry[2]);
+               info->chvinfo[0], info->chvinfo[1], info->chvinfo[2]);
   tty_fprintf (fp, "Signature counter : %lu\n", info->sig_counter);
   if (info->extcap.kdf)
     {
@@ -758,6 +758,44 @@ list_openpgp (card_info_t info, estream_t fp)
 }
 
 
+/* List PIV card specific data.  */
+static void
+list_piv (card_info_t info, estream_t fp)
+{
+  static struct keyinfolabel_s keyinfolabels[] = {
+    { "PIV Authentication:", "PIV.9A" },
+    { "Card Authenticat. :", "PIV.9E" },
+    { "Digital Signature :", "PIV.9C" },
+    { "Key Management ...:", "PIV.9D" },
+    { NULL, NULL }
+  };
+  const char *s;
+  int i;
+
+  tty_fprintf (fp, "PIN retry counter :");
+  for (i=0; i < DIM (info->chvinfo); i++)
+    {
+      if (info->chvinfo[i] > 0)
+        tty_fprintf (fp, " %d", info->chvinfo[i]);
+      else
+        {
+          switch (info->chvinfo[i])
+            {
+            case -1: s = "[error]"; break;
+            case -2: s = "-"; break;  /* No such PIN */
+            case -3: s = "[blocked]"; break;
+            case -5: s = "[verified]"; break;
+            default: s = "[?]"; break;
+            }
+          tty_fprintf (fp, " %s", s);
+        }
+    }
+  tty_fprintf (fp, "\n", s);
+  list_all_kinfo (info, keyinfolabels, fp);
+
+}
+
+
 /* Print all available information about the current card. */
 static void
 list_card (card_info_t info)
@@ -781,6 +819,7 @@ list_card (card_info_t info)
   switch (info->apptype)
     {
     case APP_TYPE_OPENPGP: list_openpgp (info, fp); break;
+    case APP_TYPE_PIV:     list_piv (info, fp); break;
     default: break;
     }
 }
@@ -1740,7 +1779,7 @@ cmd_unblock (card_info_t info)
 
   if (info->apptype == APP_TYPE_OPENPGP && !info->is_v2)
     log_error (_("This command is only available for version 2 cards\n"));
-  else if (info->apptype == APP_TYPE_OPENPGP && !info->chvretry[1])
+  else if (info->apptype == APP_TYPE_OPENPGP && !info->chvinfo[1])
     log_error (_("Reset Code not or not anymore available\n"));
   else if (info->apptype == APP_TYPE_OPENPGP)
     {

commit 237880175f59d372011cd2e20bb49726eeccf058
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 08:48:53 2019 +0100

    card: Make printing of key information more flexible.
    
    * tools/card-tool-misc.c: New.
    * tools/card-tool.h: Rewored data structures for key infos.
    * tools/gpg-card-tool.c: Ditto.
    * tools/card-call-scd.c: Ditto.
    --
    
    Note that this also changes the way the key information is printed.
    Formerly we printed it like:
    
      Signature key ....: <openpgp-fingerprint>
            created ....: <timestamp>
            keygrip ... : <keygrip>
    
    now we do:
    
      Signature key ....: <keygrip>
            fingerprint : <openpgp-fingerprint>
            created ....: <timestamp>
    
    This is because a keygrip is always available but a fingerprint and
    the creation date are properties of an OpenPGP card.  A standard way
    of listing keys is better than one depending on the type of card.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/Makefile.am b/tools/Makefile.am
index e29e6a2..f74221b 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -123,7 +123,13 @@ gpg_connect_agent_LDADD = ../common/libgpgrl.a $(common_libs) \
                           $(LIBREADLINE) $(LIBINTL) $(NETLIBS) $(LIBICONV) \
                           $(gpg_connect_agent_rc_objs)
 
-gpg_card_tool_SOURCES   = gpg-card-tool.c card-tool.h card-call-scd.c
+
+gpg_card_tool_SOURCES   = \
+	gpg-card-tool.c \
+	card-tool.h     \
+	card-call-scd.c \
+	card-tool-misc.c
+
 gpg_card_tool_LDADD     = ../common/libgpgrl.a $(common_libs) \
 	                  $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
 			  $(GPG_ERROR_LIBS) \
diff --git a/tools/card-call-scd.c b/tools/card-call-scd.c
index 7df7861..abf35ed 100644
--- a/tools/card-call-scd.c
+++ b/tools/card-call-scd.c
@@ -132,6 +132,7 @@ release_card_info (card_info_t info)
 {
   int i;
 
+
   if (!info)
     return;
 
@@ -145,12 +146,18 @@ release_card_info (card_info_t info)
   xfree (info->pubkey_url); info->pubkey_url = NULL;
   xfree (info->login_data); info->login_data = NULL;
   info->cafpr1len = info->cafpr2len = info->cafpr3len = 0;
-  info->fpr1len = info->fpr2len = info->fpr3len = 0;
   for (i=0; i < DIM(info->private_do); i++)
     {
       xfree (info->private_do[i]);
       info->private_do[i] = NULL;
     }
+  while (info->kinfo)
+    {
+      key_info_t kinfo = info->kinfo->next;
+      xfree (info->kinfo);
+      info->kinfo = kinfo;
+    }
+
 }
 
 
@@ -534,6 +541,48 @@ get_serialno_cb (void *opaque, const char *line)
 }
 
 
+
+/* For historical reasons OpenPGP cards simply use the numbers 1 to 3
+ * for the <keyref>.  Other cards and future versions of
+ * scd/app-openpgp.c may print the full keyref; i.e. "OpenPGP.1"
+ * instead of "1".  This is a helper to cope with that. */
+static const char *
+parse_keyref_helper (const char *string)
+{
+  if (*string == '1' && spacep (string+1))
+    return "OPENPGP.1";
+  else if (*string == '2' && spacep (string+1))
+    return "OPENPGP.2";
+  else if (*string == '3' && spacep (string+1))
+    return "OPENPGP.3";
+  else
+    return string;
+}
+
+
+/* Create a new key info object with KEYREF.  All fields but the
+ * keyref are zeroed out.  Never returns NULL.  The created object is
+ * appended to the list at INFO. */
+static key_info_t
+create_kinfo (card_info_t info, const char *keyref)
+{
+  key_info_t kinfo, ki;
+
+  kinfo = xcalloc (1, sizeof *kinfo + strlen (keyref));
+  strcpy (kinfo->keyref, keyref);
+
+  if (!info->kinfo)
+    info->kinfo = kinfo;
+  else
+    {
+      for (ki=info->kinfo; ki->next; ki = ki->next)
+        ;
+      ki->next = kinfo;
+    }
+  return kinfo;
+}
+
+
 /* The status callback to handle the LEARN and GETATTR commands.  */
 static gpg_error_t
 learn_status_cb (void *opaque, const char *line)
@@ -541,6 +590,10 @@ learn_status_cb (void *opaque, const char *line)
   struct card_info_s *parm = opaque;
   const char *keyword = line;
   int keywordlen;
+  char *line_buffer = NULL; /* In case we need a copy.  */
+  char *pline;
+  key_info_t kinfo;
+  const char *keyref;
   int i;
 
   for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
@@ -635,18 +688,31 @@ learn_status_cb (void *opaque, const char *line)
         }
       else if (!memcmp (keyword, "KEY-FPR", keywordlen))
         {
-          int no = atoi (line);
-
-          while (*line && !spacep (line))
-            line++;
-          while (spacep (line))
-            line++;
-          if (no == 1)
-            parm->fpr1len = unhexify_fpr (line, parm->fpr1, sizeof parm->fpr1);
-          else if (no == 2)
-            parm->fpr2len = unhexify_fpr (line, parm->fpr2, sizeof parm->fpr2);
-          else if (no == 3)
-            parm->fpr3len = unhexify_fpr (line, parm->fpr3, sizeof parm->fpr3);
+          /* The format of such a line is:
+           *   KEY-FPR <keyref> <fingerprintinhex>
+           */
+          const char *fpr;
+
+          line_buffer = pline = xstrdup (line);
+
+          keyref = parse_keyref_helper (pline);
+          while (*pline && !spacep (pline))
+            pline++;
+          if (*pline)
+            *pline++ = 0; /* Terminate keyref.  */
+          while (spacep (pline)) /* Skip to the fingerprint.  */
+            pline++;
+          fpr = pline;
+
+          /* Check whether we already have an item for the keyref.  */
+          kinfo = find_kinfo (parm, keyref);
+          if (!kinfo)  /* No: new entry.  */
+            kinfo = create_kinfo (parm, keyref);
+          else /* Existing entry - clear the fpr.  */
+            memset (kinfo->fpr, 0, sizeof kinfo->fpr);
+
+          /* Set or update or the fingerprint.  */
+          kinfo->fprlen = unhexify_fpr (fpr, kinfo->fpr, sizeof kinfo->fpr);
         }
       break;
 
@@ -664,17 +730,28 @@ learn_status_cb (void *opaque, const char *line)
         }
       else if (!memcmp (keyword, "KEY-TIME", keywordlen))
         {
-          int no = atoi (line);
-          while (* line && !spacep (line))
-            line++;
-          while (spacep (line))
-            line++;
-          if (no == 1)
-            parm->fpr1time = strtoul (line, NULL, 10);
-          else if (no == 2)
-            parm->fpr2time = strtoul (line, NULL, 10);
-          else if (no == 3)
-            parm->fpr3time = strtoul (line, NULL, 10);
+          /* The format of such a line is:
+           *   KEY-TIME <keyref> <timestamp>
+           */
+          const char *timestamp;
+
+          line_buffer = pline = xstrdup (line);
+
+          keyref = parse_keyref_helper (pline);
+          while (*pline && !spacep (pline))
+            pline++;
+          if (*pline)
+            *pline++ = 0; /* Terminate keyref.  */
+          while (spacep (pline)) /* Skip to the timestamp.  */
+            pline++;
+          timestamp = pline;
+
+          /* Check whether we already have an item for the keyref.  */
+          kinfo = find_kinfo (parm, keyref);
+          if (!kinfo)  /* No: new entry.  */
+            kinfo = create_kinfo (parm, keyref);
+
+          kinfo->created = strtoul (timestamp, NULL, 10);
         }
       else if (!memcmp (keyword, "KEY-ATTR", keywordlen))
         {
@@ -767,21 +844,29 @@ learn_status_cb (void *opaque, const char *line)
         }
       else if (!memcmp (keyword, "KEYPAIRINFO", keywordlen))
         {
+          /* The format of such a line is:
+           *   KEYPARINFO <hexgrip> <keyref>
+           */
           const char *hexgrp = line;
-          int no;
 
           while (*line && !spacep (line))
             line++;
           while (spacep (line))
             line++;
-          if (strncmp (line, "OPENPGP.", 8))
-            ;
-          else if ((no = atoi (line+8)) == 1)
-            unhexify_fpr (hexgrp, parm->grp1, sizeof parm->grp1);
-          else if (no == 2)
-            unhexify_fpr (hexgrp, parm->grp2, sizeof parm->grp2);
-          else if (no == 3)
-            unhexify_fpr (hexgrp, parm->grp3, sizeof parm->grp3);
+
+          keyref = line;
+
+          /* Check whether we already have an item for the keyref.  */
+          kinfo = find_kinfo (parm, keyref);
+          if (!kinfo)  /* New entry.  */
+            kinfo = create_kinfo (parm, keyref);
+          else /* Existing entry - clear the grip.  */
+            memset (kinfo->grip, 0, sizeof kinfo->grip);
+
+          /* Set or update the grip.  Note that due to the
+           * calloc/memset an erroneous too short grip will be nul
+           * padded on the right. */
+          unhexify_fpr (hexgrp, kinfo->grip, sizeof kinfo->grip);
         }
       break;
 
@@ -809,6 +894,7 @@ learn_status_cb (void *opaque, const char *line)
       break;
     }
 
+  xfree (line_buffer);
   return 0;
 }
 
diff --git a/tools/card-tool-misc.c b/tools/card-tool-misc.c
new file mode 100644
index 0000000..0f5fcc0
--- /dev/null
+++ b/tools/card-tool-misc.c
@@ -0,0 +1,44 @@
+/* card-tool-misc.c - Helper functions for gpg-card-tool
+ * Copyright (C) 2019 g10 Code GmbH
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#include <config.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include "../common/util.h"
+#include "../common/i18n.h"
+#include "../common/openpgpdefs.h"
+#include "card-tool.h"
+
+/* Return the key info object for the key KEYREF.  If it is not found
+ * NULL is returned.  */
+key_info_t
+find_kinfo (card_info_t info, const char *keyref)
+{
+  key_info_t kinfo;
+
+  for (kinfo = info->kinfo; kinfo; kinfo = kinfo->next)
+    if (!strcmp (kinfo->keyref, keyref))
+      return kinfo;
+  return NULL;
+}
diff --git a/tools/card-tool.h b/tools/card-tool.h
index d51698c..0af6186 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -76,6 +76,26 @@ struct key_attr
   };
 };
 
+/* An object to store information pertaining to a key pair.  This is
+ * commonly used as a linked list with all keys known for the current
+ * card.  */
+struct key_info_s
+{
+  struct key_info_s *next;
+
+  unsigned char grip[20];/* The keygrip.  */
+
+  unsigned char xflag;   /* Temporary flag to help processing a list. */
+
+  /* The three next items are mostly useful for OpenPGP cards.  */
+  unsigned char fprlen;  /* Use length of the next item.  */
+  unsigned char fpr[32]; /* The binary fingerprint of length FPRLEN.  */
+  u32 created;           /* The time the key was created.  */
+
+  char keyref[1];        /* String with the keyref (e.g. OPENPGP.1).  */
+};
+typedef struct key_info_s *key_info_t;
+
 
 /*
  * The object used to store information about a card.
@@ -100,18 +120,7 @@ struct card_info_s
   char cafpr1[20];
   char cafpr2[20];
   char cafpr3[20];
-  unsigned char fpr1len; /* Length of the fingerprint or 0 if invalid.  */
-  unsigned char fpr2len;
-  unsigned char fpr3len;
-  char fpr1[20];
-  char fpr2[20];
-  char fpr3[20];
-  u32  fpr1time;
-  u32  fpr2time;
-  u32  fpr3time;
-  char grp1[20];     /* The keygrip for OPENPGP.1 */
-  char grp2[20];     /* The keygrip for OPENPGP.2 */
-  char grp3[20];     /* The keygrip for OPENPGP.3 */
+  key_info_t kinfo;  /* Linked list with all keypair related data.  */
   unsigned long sig_counter;
   int chv1_cached;   /* True if a PIN is not required for each
                         signing.  Note that the gpg-agent might cache
@@ -133,6 +142,10 @@ struct card_info_s
 typedef struct card_info_s *card_info_t;
 
 
+/*-- card-tool-misc.c --*/
+key_info_t find_kinfo (card_info_t info, const char *keyref);
+
+
 /*-- card-call-scd.c --*/
 void release_card_info (card_info_t info);
 const char *app_type_string (app_type_t app_type);
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index b40914a..31d9c22 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -107,10 +107,19 @@ static struct debug_flags_s debug_flags [] =
   };
 
 
+/* An object to create lists of labels and keyrefs.  */
+struct keyinfolabel_s
+{
+  const char *label;
+  const char *keyref;
+};
+typedef struct keyinfolabel_s *keyinfolabel_t;
+
+
 /* Limit of size of data we read from a file for certain commands.  */
 #define MAX_GET_DATA_FROM_FILE 16384
 
-/* Constats for OpenPGP cards.  */
+/* Constants for OpenPGP cards.  */
 #define OPENPGP_USER_PIN_DEFAULT  "123456"
 #define OPENPGP_ADMIN_PIN_DEFAULT "12345678"
 #define OPENPGP_KDF_DATA_LENGTH_MIN  90
@@ -544,35 +553,101 @@ print_isoname (estream_t fp, const char *name)
 }
 
 
-/* Return true if the SHA1 fingerprint FPR consists only of zeroes. */
+/* Return true if the buffer MEM of length memlen consists only of zeroes. */
 static int
-fpr_is_zero (const char *fpr, unsigned int fprlen)
+mem_is_zero (const char *mem, unsigned int memlen)
 {
   int i;
 
-  for (i=0; i < fprlen && !fpr[i]; i++)
+  for (i=0; i < memlen && !mem[i]; i++)
     ;
-  return (i == fprlen);
+  return (i == memlen);
 }
 
 
-/* Return true if the fingerprint FPR consists only of 0xFF. */
+/* Return true if the buffer MEM or length MEMLEN consists only of 0xFF. */
 static int
-fpr_is_ff (const char *fpr, unsigned int fprlen)
+mem_is_ff (const char *mem, unsigned int memlen)
 {
   int i;
 
-  for (i=0; i < fprlen && fpr[i] == '\xff'; i++)
+  for (i=0; i < memlen && mem[i] == '\xff'; i++)
     ;
-  return (i == fprlen);
+  return (i == memlen);
 }
 
 
 

+/* Helper to list a single keyref.  */
+static void
+list_one_kinfo (key_info_t kinfo, estream_t fp)
+{
+  if (kinfo)
+    {
+      tty_fprintf (fp, " ");
+      if (mem_is_zero (kinfo->grip, sizeof kinfo->grip))
+        tty_fprintf (fp, "[none]\n");
+      else
+        print_keygrip (fp, kinfo->grip);
+
+      if (kinfo->fprlen && kinfo->created)
+        {
+          tty_fprintf (fp, "      fingerprint :");
+          print_shax_fpr (fp, kinfo->fpr, kinfo->fprlen);
+          tty_fprintf (fp, "      created ....: %s\n",
+                       isotimestamp (kinfo->created));
+        }
+    }
+  else
+    tty_fprintf (fp, " [none]\n");
+}
+
+
+/* List all keyinfo in INFO using the list of LABELS.  */
+static void
+list_all_kinfo (card_info_t info, keyinfolabel_t labels, estream_t fp)
+{
+  key_info_t kinfo;
+  int idx, i;
+
+  /* Print the keyinfo.  We first print those we known and then all
+   * remaining item.  */
+  for (kinfo = info->kinfo; kinfo; kinfo = kinfo->next)
+    kinfo->xflag = 0;
+  if (labels)
+    {
+      for (idx=0; labels[idx].label; idx++)
+        {
+          tty_fprintf (fp, "%s", labels[idx].label);
+          kinfo = find_kinfo (info, labels[idx].keyref);
+          list_one_kinfo (kinfo, fp);
+          if (kinfo)
+            kinfo->xflag = 1;
+        }
+    }
+  for (kinfo = info->kinfo; kinfo; kinfo = kinfo->next)
+    {
+      if (kinfo->xflag)
+        continue;
+      tty_fprintf (fp, "Key %s ", kinfo->keyref);
+      for (i=5+strlen (kinfo->keyref); i < 18; i++)
+        tty_fprintf (fp, ".");
+      tty_fprintf (fp, ":");
+      list_one_kinfo (kinfo, fp);
+    }
+}
+
+
 /* List OpenPGP card specific data.  */
 static void
 list_openpgp (card_info_t info, estream_t fp)
 {
+  static struct keyinfolabel_s keyinfolabels[] = {
+    { "Signature key ....:", "OPENPGP.1" },
+    { "Encryption key....:", "OPENPGP.2" },
+    { "Authentication key:", "OPENPGP.3" },
+    { NULL, NULL }
+  };
   int i;
 
   if (!info->serialno
@@ -661,33 +736,8 @@ list_openpgp (card_info_t info, estream_t fp)
                    info->uif[0] ? "on" : "off", info->uif[1] ? "on" : "off",
                    info->uif[2] ? "on" : "off");
     }
-  tty_fprintf (fp, "Signature key ....:");
-  print_shax_fpr (fp, info->fpr1len? info->fpr1:NULL, info->fpr1len);
-  if (info->fpr1len && info->fpr1time)
-    {
-      tty_fprintf (fp, "      created ....: %s\n",
-                   isotimestamp (info->fpr1time));
-      tty_fprintf (fp, "      keygrip ....: ");
-      print_keygrip (fp, info->grp1);
-    }
-  tty_fprintf (fp, "Encryption key....:");
-  print_shax_fpr (fp, info->fpr2len? info->fpr2:NULL, info->fpr2len);
-  if (info->fpr2len && info->fpr2time)
-    {
-      tty_fprintf (fp, "      created ....: %s\n",
-                   isotimestamp (info->fpr2time));
-      tty_fprintf (fp, "      keygrip ....: ");
-      print_keygrip (fp, info->grp2);
-    }
-  tty_fprintf (fp, "Authentication key:");
-  print_shax_fpr (fp, info->fpr3len? info->fpr3:NULL, info->fpr3len);
-  if (info->fpr3len && info->fpr3time)
-    {
-      tty_fprintf (fp, "      created ....: %s\n",
-                   isotimestamp (info->fpr3time));
-      tty_fprintf (fp, "      keygrip ....: ");
-      print_keygrip (fp, info->grp3);
-    }
+
+  list_all_kinfo (info, keyinfolabels, fp);
 
   /* tty_fprintf (fp, "General key info->.: "); */
   /* thefpr = (info->fpr1len? info->fpr1 : info->fpr2len? info->fpr2 : */
@@ -696,7 +746,7 @@ list_openpgp (card_info_t info, estream_t fp)
   /*              info->fpr3len? info->fpr3len : 0); */
   /* If the fingerprint is all 0xff, the key has no associated
      OpenPGP certificate.  */
-  /* if ( thefpr && !fpr_is_ff (thefpr, thefprlen) */
+  /* if ( thefpr && !mem_is_ff (thefpr, thefprlen) */
   /*      && !get_pubkey_byfprint (ctrl, pk, &keyblock, thefpr, thefprlen)) */
   /*   { */
       /* print_pubkey_info (ctrl, fp, pk); */
@@ -900,6 +950,7 @@ static gpg_error_t
 cmd_fetch (card_info_t info)
 {
   gpg_error_t err;
+  key_info_t kinfo;
 
   if (!info)
     return print_help
@@ -916,7 +967,7 @@ cmd_fetch (card_info_t info)
       /* free_strlist (sl); */
       err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);  /* FIXME */
     }
-  else if (info->fpr1len)
+  else if ((kinfo = find_kinfo (info, "OPENPGP.1")) && kinfo->fprlen)
     {
       /* rc = keyserver_import_fprint (ctrl, info.fpr1, info.fpr1len, */
       /*                               opt.keyserver, 0); */
@@ -1479,6 +1530,7 @@ cmd_generate (card_info_t info)
   int forced_chv1 = -1;
   int want_backup;
   char *answer = NULL;
+  key_info_t kinfo1, kinfo2, kinfo3;
 
   if (!info)
     return print_help
@@ -1507,9 +1559,15 @@ cmd_generate (card_info_t info)
   else
     want_backup = 0;
 
-  if ( (info->fpr1len && !fpr_is_zero (info->fpr1, info->fpr1len))
-       || (info->fpr2len && !fpr_is_zero (info->fpr2, info->fpr2len))
-       || (info->fpr3len && !fpr_is_zero (info->fpr3, info->fpr3len)))
+
+  kinfo1 = find_kinfo (info, "OPENPGP.1");
+  kinfo2 = find_kinfo (info, "OPENPGP.2");
+  kinfo3 = find_kinfo (info, "OPENPGP.3");
+
+  if ((kinfo1 && kinfo1->fprlen && !mem_is_zero (kinfo1->fpr,kinfo1->fprlen))
+      || (kinfo2 && kinfo2->fprlen && !mem_is_zero (kinfo2->fpr,kinfo2->fprlen))
+      || (kinfo3 && kinfo3->fprlen && !mem_is_zero (kinfo3->fpr,kinfo3->fprlen))
+      )
     {
       tty_printf ("\n");
       log_info (_("Note: keys are already stored on the card!\n"));

-----------------------------------------------------------------------

Summary of changes:
 scd/app-piv.c                                |   5 +-
 tools/Makefile.am                            |   8 +-
 tools/card-call-scd.c                        | 176 ++++++++++++++++++++------
 g13/be-truecrypt.c => tools/card-tool-misc.c |  25 ++--
 tools/card-tool.h                            |  47 ++++---
 tools/gpg-card-tool.c                        | 183 ++++++++++++++++++++-------
 6 files changed, 336 insertions(+), 108 deletions(-)
 copy g13/be-truecrypt.c => tools/card-tool-misc.c (60%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 29 13:47:31 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 29 Jan 2019 13:47:31 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-338-g79bed50
Message-ID: <E1goSnc-0001kj-FB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  79bed504e51034d960fcb858fb643901cad85913 (commit)
      from  9325c92284bb346d11c3591bb2ea88095989361a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 79bed504e51034d960fcb858fb643901cad85913
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 13:28:10 2019 +0100

    card: Support factory reset for Yubikey PIV application.
    
    * scd/app-common.h (struct app_ctx_s): Add field cardtype.
    * scd/app.c (app_new_register): Set cardtype for yubikey.
    (app_getattr): Add CARDTYPE.
    (app_write_learn_status): Emit new attribute.
    * scd/app-piv.c (do_getattr): Add CHV-USAGE.
    (do_learn_status): Emit it.
    * tools/card-tool.h (struct card_info_s): Add field cardtype.
    * tools/card-call-scd.c (learn_status_cb): Parse "CARDTYPE".
    
    * tools/gpg-card-tool.c (list_piv): Print PIN usage policy.
    (list_card): Print card type.
    (cmd_factoryreset): Implement for Yubikey with PIV.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/app-common.h b/scd/app-common.h
index b1661b5..98d8464 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -52,6 +52,7 @@ struct app_ctx_s {
 
   unsigned char *serialno; /* Serialnumber in raw form, allocated. */
   size_t serialnolen;      /* Length in octets of serialnumber. */
+  const char *cardtype;    /* NULL or string with the token's type.  */
   const char *apptype;
   unsigned int card_version;
   unsigned int card_status;
diff --git a/scd/app-piv.c b/scd/app-piv.c
index 69f12f4..d984e9c 100644
--- a/scd/app-piv.c
+++ b/scd/app-piv.c
@@ -469,13 +469,16 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
     { "SERIALNO",     0x0000, -1 },
     { "$AUTHKEYID",   0x0000, -2 }, /* Default key for ssh.  */
     { "$DISPSERIALNO",0x0000, -3 },
-    { "CHV-STATUS",   0x0000, -4 }
+    { "CHV-STATUS",   0x0000, -4 },
+    { "CHV-USAGE",    0x007E, -5 }
   };
   gpg_error_t err = 0;
   int idx;
   void *relptr;
   unsigned char *value;
   size_t valuelen;
+  const unsigned char *s;
+  size_t n;
 
   for (idx=0; (idx < DIM (table)
                && ascii_strcasecmp (table[idx].name, name)); idx++)
@@ -521,6 +524,20 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
       err = send_status_printf (ctrl, table[idx].name, "%d %d %d",
                                 tmp[0], tmp[1], tmp[2]);
     }
+  else if (table[idx].special == -5) /* CHV-USAGE (aka PIN Usage Policy) */
+    {
+      /* We return 2 hex bytes or nothing in case the discovery object
+       * is not supported.  */
+      relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &err);
+      if (relptr)
+        {
+          s = find_tlv (value, valuelen, 0x7E, &n);
+          if (s && n && (s = find_tlv (s, n, 0x5F2F, &n)) && n >=2 )
+            err = send_status_printf (ctrl, table[idx].name, "%02X %02X",
+                                      s[0], s[1]);
+          xfree (relptr);
+        }
+    }
   else
     {
       relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &err);
@@ -577,6 +594,7 @@ do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 
   (void)flags;
 
+  do_getattr (app, ctrl, "CHV-USAGE");
   do_getattr (app, ctrl, "CHV-STATUS");
 
   for (i=0; data_objects[i].tag; i++)
diff --git a/scd/app.c b/scd/app.c
index 219cee6..c79a174 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -228,6 +228,7 @@ app_new_register (int slot, ctrl_t ctrl, const char *name,
               && !iso7816_apdu_direct (slot, "\x00\x1d\x00\x00\x00", 5, 0,
                                        NULL, &buf, &buflen))
             {
+              app->cardtype = "yubikey";
               if (opt.verbose)
                 {
                   log_info ("Yubico: config=");
@@ -640,9 +641,12 @@ app_write_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
   if (!app->fnc.learn_status)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
-  /* We do not send APPTYPE if only keypairinfo is requested.  */
+  /* We do not send CARD and APPTYPE if only keypairinfo is requested.  */
+  if (app->cardtype && !(flags & 1))
+    send_status_direct (ctrl, "CARDTYPE", app->cardtype);
   if (app->apptype && !(flags & 1))
     send_status_direct (ctrl, "APPTYPE", app->apptype);
+
   err = lock_app (app, ctrl);
   if (err)
     return err;
@@ -721,6 +725,11 @@ app_getattr (app_t app, ctrl_t ctrl, const char *name)
   if (!app->ref_count)
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
 
+  if (app->cardtype && name && !strcmp (name, "CARDTYPE"))
+    {
+      send_status_direct (ctrl, "CARDTYPE", app->cardtype);
+      return 0;
+    }
   if (app->apptype && name && !strcmp (name, "APPTYPE"))
     {
       send_status_direct (ctrl, "APPTYPE", app->apptype);
@@ -744,7 +753,7 @@ app_getattr (app_t app, ctrl_t ctrl, const char *name)
   err = lock_app (app, ctrl);
   if (err)
     return err;
-  err =  app->fnc.getattr (app, ctrl, name);
+  err = app->fnc.getattr (app, ctrl, name);
   unlock_app (app);
   return err;
 }
diff --git a/tools/card-call-scd.c b/tools/card-call-scd.c
index 2551b19..9a742a7 100644
--- a/tools/card-call-scd.c
+++ b/tools/card-call-scd.c
@@ -137,6 +137,7 @@ release_card_info (card_info_t info)
     return;
 
   xfree (info->reader); info->reader = NULL;
+  xfree (info->cardtype); info->cardtype = NULL;
   xfree (info->serialno); info->serialno = NULL;
   xfree (info->dispserialno); info->dispserialno = NULL;
   xfree (info->apptypestr); info->apptypestr = NULL;
@@ -157,7 +158,7 @@ release_card_info (card_info_t info)
       xfree (info->kinfo);
       info->kinfo = kinfo;
     }
-
+  info->chvusage[0] = info->chvusage[1] = 0;
 }
 
 
@@ -724,6 +725,11 @@ learn_status_cb (void *opaque, const char *line)
           parm->is_v2 = (strlen (parm->serialno) >= 16
                          && xtoi_2 (parm->serialno+12) >= 2 );
         }
+      else if (!memcmp (keyword, "CARDTYPE", keywordlen))
+        {
+          xfree (parm->cardtype);
+          parm->cardtype = unescape_status_string (line);
+        }
       else if (!memcmp (keyword, "DISP-SEX", keywordlen))
         {
           parm->disp_sex = *line == '1'? 1 : *line == '2' ? 2: 0;
@@ -779,17 +785,26 @@ learn_status_cb (void *opaque, const char *line)
       break;
 
     case 9:
-        if (!memcmp (keyword, "DISP-NAME", keywordlen))
-          {
-            xfree (parm->disp_name);
-            parm->disp_name = unescape_status_string (line);
-          }
-        else if (!memcmp (keyword, "DISP-LANG", keywordlen))
-          {
-            xfree (parm->disp_lang);
-            parm->disp_lang = unescape_status_string (line);
-          }
-      break;
+      if (!memcmp (keyword, "DISP-NAME", keywordlen))
+        {
+          xfree (parm->disp_name);
+          parm->disp_name = unescape_status_string (line);
+        }
+      else if (!memcmp (keyword, "DISP-LANG", keywordlen))
+        {
+          xfree (parm->disp_lang);
+          parm->disp_lang = unescape_status_string (line);
+        }
+      else if (!memcmp (keyword, "CHV-USAGE", keywordlen))
+        {
+          unsigned int byte1, byte2;
+
+          byte1 = byte2 = 0;
+          sscanf (line, "%x %x", &byte1, &byte2);
+          parm->chvusage[0] = byte1;
+          parm->chvusage[1] = byte2;
+        }
+        break;
 
     case 10:
       if (!memcmp (keyword, "PUBKEY-URL", keywordlen))
@@ -839,7 +854,7 @@ learn_status_cb (void *opaque, const char *line)
             }
           else if (parm->apptype == APP_TYPE_PIV)
             {
-              for (i=0; *p && DIM (parm->chvinfo); i++)
+              for (i=0; *p && i < DIM (parm->chvinfo); i++)
                 {
                   parm->chvinfo[i] = atoi (p);
                   while (*p && !spacep (p))
diff --git a/tools/card-tool.h b/tools/card-tool.h
index bcc257c..b1d8662 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -104,6 +104,7 @@ struct card_info_s
 {
   int error;         /* private. */
   char *reader;      /* Reader information.  */
+  char *cardtype;    /* NULL or type of the card.  */
   char *apptypestr;  /* Malloced application type string.  */
   app_type_t apptype;/* Translated from APPTYPESTR.  */
   char *serialno;    /* malloced hex string. */
@@ -128,6 +129,7 @@ struct card_info_s
   int is_v2;         /* True if this is a v2 openpgp card.  */
   int chvmaxlen[3];  /* Maximum allowed length of a CHV. */
   int chvinfo[3];    /* Allowed retries for the CHV; 0 = blocked. */
+  unsigned char chvusage[2]; /* Data object 5F2F */
   struct key_attr key_attr[3]; /* OpenPGP card key attributes.  */
   struct {
     unsigned int ki:1;     /* Key import available.  */
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index 5ba44fc..4f79620 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -763,15 +763,37 @@ static void
 list_piv (card_info_t info, estream_t fp)
 {
   static struct keyinfolabel_s keyinfolabels[] = {
-    { "PIV Authentication:", "PIV.9A" },
-    { "Card Authenticat. :", "PIV.9E" },
-    { "Digital Signature :", "PIV.9C" },
-    { "Key Management ...:", "PIV.9D" },
+    { "PIV authentication:", "PIV.9A" },
+    { "Card authenticat. :", "PIV.9E" },
+    { "Digital signature :", "PIV.9C" },
+    { "Key management ...:", "PIV.9D" },
     { NULL, NULL }
   };
   const char *s;
   int i;
 
+  if (info->chvusage[0] || info->chvusage[1])
+    {
+      tty_fprintf (fp, "PIN usage policy .:");
+      if ((info->chvusage[0] & 0x40))
+          tty_fprintf (fp, " app-pin");
+      if ((info->chvusage[0] & 0x20))
+        tty_fprintf (fp, " global-pin");
+      if ((info->chvusage[0] & 0x10))
+        tty_fprintf (fp, " occ");
+      if ((info->chvusage[0] & 0x08))
+        tty_fprintf (fp, " vci");
+      if ((info->chvusage[0] & 0x08) && !(info->chvusage[0] & 0x04))
+        tty_fprintf (fp, " pairing");
+
+      if (info->chvusage[1] == 0x10)
+        tty_fprintf (fp, " primary:card");
+      else if (info->chvusage[1] == 0x20)
+        tty_fprintf (fp, " primary:global");
+
+      tty_fprintf (fp, "\n");
+    }
+
   tty_fprintf (fp, "PIN retry counter :");
   for (i=0; i < DIM (info->chvinfo); i++)
     {
@@ -790,7 +812,7 @@ list_piv (card_info_t info, estream_t fp)
           tty_fprintf (fp, " %s", s);
         }
     }
-  tty_fprintf (fp, "\n", s);
+  tty_fprintf (fp, "\n");
   list_all_kinfo (info, keyinfolabels, fp);
 
 }
@@ -804,9 +826,11 @@ list_card (card_info_t info)
 
   tty_fprintf (fp, "Reader ...........: %s\n",
                info->reader? info->reader : "[none]");
+  if (info->cardtype)
+    tty_fprintf (fp, "Card type ........: %s\n", info->cardtype);
   tty_fprintf (fp, "Serial number ....: %s\n",
                info->serialno? info->serialno : "[none]");
-  tty_fprintf (fp, "Application Type .: %s%s%s%s\n",
+  tty_fprintf (fp, "Application type .: %s%s%s%s\n",
                app_type_string (info->apptype),
                info->apptype == APP_TYPE_UNKNOWN && info->apptypestr? "(":"",
                info->apptype == APP_TYPE_UNKNOWN && info->apptypestr
@@ -1836,26 +1860,32 @@ cmd_factoryreset (card_info_t info)
   char *answer = NULL;
   int termstate = 0;
   int any_apdu = 0;
+  int is_yubikey = 0;
   int i;
 
 
   if (!info)
     return print_help
       ("FACTORY-RESET\n\n"
-       "Do a complete reset of an OpenPGP card.  This deletes all\n"
-       "data and keys and resets the PINs to their default.  This\n"
-       "mainly used by developers with scratch cards.  Don't worry,\n"
-       "you need to confirm before the command proceeds.",
-       APP_TYPE_OPENPGP, 0);
+       "Do a complete reset of some OpenPGP and PIV cards.  This\n"
+       "deletes all data and keys and resets the PINs to their default.\n"
+       "This is mainly used by developers with scratch cards.  Don't\n"
+       "worry, you need to confirm before the command proceeds.",
+       APP_TYPE_OPENPGP, APP_TYPE_PIV, 0);
 
-  if (info->apptype != APP_TYPE_OPENPGP)
-    {
-      log_info ("Note: This is an OpenPGP only command.\n");
-      return gpg_error (GPG_ERR_NOT_SUPPORTED);
-    }
+  /* We support the factory reset for most OpenPGP cards and Yubikeys
+   * with the PIV application.  */
+  if (info->apptype == APP_TYPE_OPENPGP)
+    ;
+  else if (info->apptype == APP_TYPE_PIV
+           && info->cardtype && !strcmp (info->cardtype, "yubikey"))
+    is_yubikey = 1;
+  else
+
+    return gpg_error (GPG_ERR_NOT_SUPPORTED);
 
-  /* The code below basically does the same what this
-   * gpg-connect-agent script does:
+  /* For an OpenPGP card the code below basically does the same what
+   * this gpg-connect-agent script does:
    *
    *   scd reset
    *   scd serialno undefined
@@ -1873,7 +1903,8 @@ cmd_factoryreset (card_info_t info)
    *   scd reset
    *   /echo Card has been reset to factory defaults
    *
-   * but tries to find out something about the card first.
+   * For a PIV application on a Yubikey it merely issues the Yubikey
+   * specific resset command.
    */
 
   err = scd_learn (info);
@@ -1886,17 +1917,24 @@ cmd_factoryreset (card_info_t info)
       goto leave;
     }
 
-  if (!termstate)
+  if (!termstate || is_yubikey)
     {
-      log_info (_("OpenPGP card no. %s detected\n"),
-                info->dispserialno? info->dispserialno : info->serialno);
-      if (!(info->status_indicator == 3 || info->status_indicator == 5))
+      if (is_yubikey)
+        log_info (_("Yubikey no. %s with PIV application detected\n"),
+                  info->dispserialno? info->dispserialno : info->serialno);
+      else
         {
-          /* Note: We won't see status-indicator 3 here because it is not
-           * possible to select a card application in termination state.  */
-          log_error (_("This command is not supported by this card\n"));
-          err = gpg_error (GPG_ERR_NOT_SUPPORTED);
-          goto leave;
+          log_info (_("OpenPGP card no. %s detected\n"),
+                    info->dispserialno? info->dispserialno : info->serialno);
+          if (!(info->status_indicator == 3 || info->status_indicator == 5))
+            {
+              /* Note: We won't see status-indicator 3 here because it
+               * is not possible to select a card application in
+               * termination state.  */
+              log_error (_("This command is not supported by this card\n"));
+              err = gpg_error (GPG_ERR_NOT_SUPPORTED);
+              goto leave;
+            }
         }
 
       tty_printf ("\n");
@@ -1924,51 +1962,73 @@ cmd_factoryreset (card_info_t info)
           goto leave;
         }
 
-      any_apdu = 1;
-      /* We need to select a card application before we can send APDUs
-       * to the card without scdaemon doing anything on its own.  */
-      err = send_apdu (NULL, "RESET", 0);
-      if (err)
-        goto leave;
-      err = send_apdu ("undefined", "dummy select ", 0);
-      if (err)
-        goto leave;
 
-      /* Select the OpenPGP application.  */
-      err = send_apdu ("00A4040006D27600012401", "SELECT AID", 0);
-      if (err)
-        goto leave;
+      if (is_yubikey)
+        {
+          /* The PIV application si already selected, we only need to
+           * send the special reset APDU after having blocked PIN and
+           * PUK.  Note that blocking the PUK is done using the
+           * unblock PIN command.  */
+          any_apdu = 1;
+          for (i=0; i < 5; i++)
+            send_apdu ("0020008008FFFFFFFFFFFFFFFF", "VERIFY", 0xffff);
+          for (i=0; i < 5; i++)
+            send_apdu ("002C008010FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
+                       "RESET RETRY COUNTER", 0xffff);
+          err = send_apdu ("00FB000001FF", "YUBIKEY RESET", 0);
+          if (err)
+            goto leave;
+        }
+      else /* OpenPGP card.  */
+        {
+          any_apdu = 1;
+          /* We need to select a card application before we can send APDUs
+           * to the card without scdaemon doing anything on its own.  */
+          err = send_apdu (NULL, "RESET", 0);
+          if (err)
+            goto leave;
+          err = send_apdu ("undefined", "dummy select ", 0);
+          if (err)
+            goto leave;
+          /* Select the OpenPGP application.  */
+          err = send_apdu ("00A4040006D27600012401", "SELECT AID", 0);
+          if (err)
+            goto leave;
+
+          /* Do some dummy verifies with wrong PINs to set the retry
+           * counter to zero.  We can't easily use the card version 2.1
+           * feature of presenting the admin PIN to allow the terminate
+           * command because there is no machinery in scdaemon to catch
+           * the verify command and ask for the PIN when the "APDU"
+           * command is used.
+           * Here, the length of dummy wrong PIN is 32-byte, also
+           * supporting authentication with KDF DO.  */
+          for (i=0; i < 4; i++)
+            send_apdu ("0020008120"
+                       "40404040404040404040404040404040"
+                       "40404040404040404040404040404040", "VERIFY", 0xffff);
+          for (i=0; i < 4; i++)
+            send_apdu ("0020008320"
+                       "40404040404040404040404040404040"
+                       "40404040404040404040404040404040", "VERIFY", 0xffff);
+
+          /* Send terminate datafile command.  */
+          err = send_apdu ("00e60000", "TERMINATE DF", 0x6985);
+          if (err)
+            goto leave;
+        }
+    }
 
-      /* Do some dummy verifies with wrong PINs to set the retry
-       * counter to zero.  We can't easily use the card version 2.1
-       * feature of presenting the admin PIN to allow the terminate
-       * command because there is no machinery in scdaemon to catch
-       * the verify command and ask for the PIN when the "APDU"
-       * command is used.
-       * Here, the length of dummy wrong PIN is 32-byte, also
-       * supporting authentication with KDF DO.  */
-      for (i=0; i < 4; i++)
-        send_apdu ("0020008120"
-                   "40404040404040404040404040404040"
-                   "40404040404040404040404040404040", "VERIFY", 0xffff);
-      for (i=0; i < 4; i++)
-        send_apdu ("0020008320"
-                   "40404040404040404040404040404040"
-                   "40404040404040404040404040404040", "VERIFY", 0xffff);
-
-      /* Send terminate datafile command.  */
-      err = send_apdu ("00e60000", "TERMINATE DF", 0x6985);
+  if (!is_yubikey)
+    {
+      any_apdu = 1;
+      /* Send activate datafile command.  This is used without
+       * confirmation if the card is already in termination state.  */
+      err = send_apdu ("00440000", "ACTIVATE DF", 0);
       if (err)
         goto leave;
     }
 
-  any_apdu = 1;
-  /* Send activate datafile command.  This is used without
-   * confirmation if the card is already in termination state.  */
-  err = send_apdu ("00440000", "ACTIVATE DF", 0);
-  if (err)
-    goto leave;
-
   /* Finally we reset the card reader once more.  */
   err = send_apdu (NULL, "RESET", 0);
   if (err)
@@ -1979,7 +2039,7 @@ cmd_factoryreset (card_info_t info)
   err = scd_serialno (&answer, NULL);
 
  leave:
-  if (err && any_apdu)
+  if (err && any_apdu && !is_yubikey)
     {
       log_info ("Due to an error the card might be in an inconsistent state\n"
                 "You should run the LIST command to check this.\n");

-----------------------------------------------------------------------

Summary of changes:
 scd/app-common.h      |   1 +
 scd/app-piv.c         |  20 +++++-
 scd/app.c             |  13 +++-
 tools/card-call-scd.c |  41 +++++++----
 tools/card-tool.h     |   2 +
 tools/gpg-card-tool.c | 196 ++++++++++++++++++++++++++++++++------------------
 6 files changed, 189 insertions(+), 84 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 29 18:23:45 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 29 Jan 2019 18:23:45 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-340-gf382984
Message-ID: <E1goX6x-0003TT-4C@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f382984966a31a4cbe572bce5370590c5490ed1e (commit)
       via  4a1558d0c7190cf13d35385e47291a7aa121be3e (commit)
      from  79bed504e51034d960fcb858fb643901cad85913 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f382984966a31a4cbe572bce5370590c5490ed1e
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 18:20:34 2019 +0100

    common: Provide some convenient OpenPGP related constants.
    
    * common/openpgpdefs.h (OPENPGP_MAX_NPKEY): New.
    (OPENPGP_MAX_NSKEY): New.
    (OPENPGP_MAX_NSIG): New.
    (OPENPGP_MAX_NENC): New.
    * g10/packet.h: Define PUBKEY_MAX using the new consts.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/openpgpdefs.h b/common/openpgpdefs.h
index aadda43..2f7ff45 100644
--- a/common/openpgpdefs.h
+++ b/common/openpgpdefs.h
@@ -196,7 +196,11 @@ typedef enum
   }
 compress_algo_t;
 
-
+/* Limits to be used for static arrays.  */
+#define OPENPGP_MAX_NPKEY  5  /* Maximum number of public key parameters. */
+#define OPENPGP_MAX_NSKEY  7  /* Maximum number of secret key parameters. */
+#define OPENPGP_MAX_NSIG   2  /* Maximum number of signature parameters.  */
+#define OPENPGP_MAX_NENC   2  /* Maximum number of encryption parameters. */
 
 
 /* Decode an rfc4880 encoded S2K count.  */
diff --git a/g10/packet.h b/g10/packet.h
index 78a57ba..6160d0b 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -34,11 +34,11 @@
 #define DEBUG_PARSE_PACKET 1
 
 
-/* Constants to allocate static MPI arrays. */
-#define PUBKEY_MAX_NPKEY  5
-#define PUBKEY_MAX_NSKEY  7
-#define PUBKEY_MAX_NSIG   2
-#define PUBKEY_MAX_NENC   2
+/* Constants to allocate static MPI arrays.  */
+#define PUBKEY_MAX_NPKEY  OPENPGP_MAX_NPKEY
+#define PUBKEY_MAX_NSKEY  OPENPGP_MAX_NSKEY
+#define PUBKEY_MAX_NSIG   OPENPGP_MAX_NSIG
+#define PUBKEY_MAX_NENC   OPENPGP_MAX_NENC
 
 /* Usage flags */
 #define PUBKEY_USAGE_SIG     GCRY_PK_USAGE_SIGN  /* Good for signatures. */

commit 4a1558d0c7190cf13d35385e47291a7aa121be3e
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 18:19:05 2019 +0100

    common: New helper functions for OpenPGP curve OIDs.
    
    * common/openpgp-oid.c (openpgp_oidbuf_to_str): Factor most code out
    to ...
    (openpgp_oidbuf_to_str): new.
    (openpgp_oidbuf_is_ed25519): New.
    (openpgp_oidbuf_is_cv25519): New.
    --
    
    At some places it is more convenient (and faster) to directly work on
    buffers and avoid the way via opaque MPIs.  These 3 new functions
    allow for that.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/openpgp-oid.c b/common/openpgp-oid.c
index 86885e0..4194718 100644
--- a/common/openpgp-oid.c
+++ b/common/openpgp-oid.c
@@ -184,48 +184,36 @@ openpgp_oid_from_str (const char *string, gcry_mpi_t *r_mpi)
 }
 
 
-/* Return a malloced string representation of the OID in the opaque MPI
-   A.  In case of an error NULL is returned and ERRNO is set.  */
+/* Return a malloced string representation of the OID in the buffer
+ * (BUF,LEN).  In case of an error NULL is returned and ERRNO is set.
+ * As per OpenPGP spec the first byte of the buffer is the length of
+ * the rest; the function performs a consistency check.  */
 char *
-openpgp_oid_to_str (gcry_mpi_t a)
+openpgp_oidbuf_to_str (const unsigned char *buf, size_t len)
 {
-  const unsigned char *buf;
-  size_t length;
-  unsigned int lengthi;
   char *string, *p;
   int n = 0;
   unsigned long val, valmask;
 
   valmask = (unsigned long)0xfe << (8 * (sizeof (valmask) - 1));
-
-  if (!a
-      || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE)
-      || !(buf = gcry_mpi_get_opaque (a, &lengthi)))
-    {
-      gpg_err_set_errno (EINVAL);
-      return NULL;
-    }
-
-  buf = gcry_mpi_get_opaque (a, &lengthi);
-  length = (lengthi+7)/8;
-
   /* The first bytes gives the length; check consistency.  */
-  if (!length || buf[0] != length -1)
+
+  if (!len || buf[0] != len -1)
     {
       gpg_err_set_errno (EINVAL);
       return NULL;
     }
   /* Skip length byte.  */
-  length--;
+  len--;
   buf++;
 
   /* To calculate the length of the string we can safely assume an
      upper limit of 3 decimal characters per byte.  Two extra bytes
      account for the special first octet */
-  string = p = xtrymalloc (length*(1+3)+2+1);
+  string = p = xtrymalloc (len*(1+3)+2+1);
   if (!string)
     return NULL;
-  if (!length)
+  if (!len)
     {
       *p = 0;
       return string;
@@ -237,7 +225,7 @@ openpgp_oid_to_str (gcry_mpi_t a)
     p += sprintf (p, "1.%d", buf[n]-40);
   else {
     val = buf[n] & 0x7f;
-    while ( (buf[n]&0x80) && ++n < length )
+    while ( (buf[n]&0x80) && ++n < len )
       {
         if ( (val & valmask) )
           goto badoid;  /* Overflow.  */
@@ -250,10 +238,10 @@ openpgp_oid_to_str (gcry_mpi_t a)
     sprintf (p, "2.%lu", val);
     p += strlen (p);
   }
-  for (n++; n < length; n++)
+  for (n++; n < len; n++)
     {
       val = buf[n] & 0x7f;
-      while ( (buf[n]&0x80) && ++n < length )
+      while ( (buf[n]&0x80) && ++n < len )
         {
           if ( (val & valmask) )
             goto badoid;  /* Overflow.  */
@@ -278,6 +266,35 @@ openpgp_oid_to_str (gcry_mpi_t a)
 }
 
 
+/* Return a malloced string representation of the OID in the opaque
+ * MPI A.  In case of an error NULL is returned and ERRNO is set.  */
+char *
+openpgp_oid_to_str (gcry_mpi_t a)
+{
+  const unsigned char *buf;
+  unsigned int lengthi;
+
+  if (!a
+      || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE)
+      || !(buf = gcry_mpi_get_opaque (a, &lengthi)))
+    {
+      gpg_err_set_errno (EINVAL);
+      return NULL;
+    }
+
+  buf = gcry_mpi_get_opaque (a, &lengthi);
+  return openpgp_oidbuf_to_str (buf, (lengthi+7)/8);
+}
+
+
+/* Return true if (BUF,LEN) represents the OID for Ed25519.  */
+int
+openpgp_oidbuf_is_ed25519 (const void *buf, size_t len)
+{
+  return (buf && len == DIM (oid_ed25519)
+          && !memcmp (buf, oid_ed25519, DIM (oid_ed25519)));
+}
+
 
 /* Return true if A represents the OID for Ed25519.  */
 int
@@ -285,32 +302,36 @@ openpgp_oid_is_ed25519 (gcry_mpi_t a)
 {
   const unsigned char *buf;
   unsigned int nbits;
-  size_t n;
 
   if (!a || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
     return 0;
 
   buf = gcry_mpi_get_opaque (a, &nbits);
-  n = (nbits+7)/8;
-  return (n == DIM (oid_ed25519)
-          && !memcmp (buf, oid_ed25519, DIM (oid_ed25519)));
+  return openpgp_oidbuf_is_ed25519 (buf, (nbits+7)/8);
 }
 
 
+/* Return true if (BUF,LEN) represents the OID for Curve25519.  */
+int
+openpgp_oidbuf_is_cv25519 (const void *buf, size_t len)
+{
+  return (buf && len == DIM (oid_cv25519)
+          && !memcmp (buf, oid_cv25519, DIM (oid_cv25519)));
+}
+
+
+/* Return true if the MPI A represents the OID for Curve25519.  */
 int
 openpgp_oid_is_cv25519 (gcry_mpi_t a)
 {
   const unsigned char *buf;
   unsigned int nbits;
-  size_t n;
 
   if (!a || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
     return 0;
 
   buf = gcry_mpi_get_opaque (a, &nbits);
-  n = (nbits+7)/8;
-  return (n == DIM (oid_cv25519)
-          && !memcmp (buf, oid_cv25519, DIM (oid_cv25519)));
+  return openpgp_oidbuf_is_cv25519 (buf, (nbits+7)/8);
 }
 
 
diff --git a/common/t-openpgp-oid.c b/common/t-openpgp-oid.c
index cb5709d..fd9de5d 100644
--- a/common/t-openpgp-oid.c
+++ b/common/t-openpgp-oid.c
@@ -142,7 +142,15 @@ test_openpgp_oid_to_str (void)
         fail (idx, 0);
       xfree (string);
       gcry_mpi_release (a);
-    }
+
+      /* Again using the buffer variant. */
+      string = openpgp_oidbuf_to_str (samples[idx].der, samples[idx].der[0]+1);
+      if (!string)
+        fail (idx, gpg_error_from_syserror ());
+      if (strcmp (string, samples[idx].string))
+        fail (idx, 0);
+      xfree (string);
+}
 
 }
 
diff --git a/common/util.h b/common/util.h
index d3a846f..8234b62 100644
--- a/common/util.h
+++ b/common/util.h
@@ -211,8 +211,11 @@ size_t percent_unescape_inplace (char *string, int nulrepl);
 
 /*-- openpgp-oid.c --*/
 gpg_error_t openpgp_oid_from_str (const char *string, gcry_mpi_t *r_mpi);
+char *openpgp_oidbuf_to_str (const unsigned char *buf, size_t len);
 char *openpgp_oid_to_str (gcry_mpi_t a);
+int openpgp_oidbuf_is_ed25519 (const void *buf, size_t len);
 int openpgp_oid_is_ed25519 (gcry_mpi_t a);
+int openpgp_oidbuf_is_cv25519 (const void *buf, size_t len);
 int openpgp_oid_is_cv25519 (gcry_mpi_t a);
 const char *openpgp_curve_to_oid (const char *name, unsigned int *r_nbits);
 const char *openpgp_oid_to_curve (const char *oid, int canon);

-----------------------------------------------------------------------

Summary of changes:
 common/openpgp-oid.c   | 87 +++++++++++++++++++++++++++++++-------------------
 common/openpgpdefs.h   |  6 +++-
 common/t-openpgp-oid.c | 10 +++++-
 common/util.h          |  3 ++
 g10/packet.h           | 10 +++---
 5 files changed, 76 insertions(+), 40 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 29 20:11:42 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 29 Jan 2019 20:11:42 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-341-gc128667
Message-ID: <E1goYnP-0005fq-Uk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c128667b3cba749dd14262e032d4c260a2b0acd3 (commit)
      from  f382984966a31a4cbe572bce5370590c5490ed1e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c128667b3cba749dd14262e032d4c260a2b0acd3
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 19:52:08 2019 +0100

    gpg: Implement searching keys via keygrip.
    
    * kbx/keybox-defs.h (struct _keybox_openpgp_key_info): Add field grip.
    * kbx/keybox-openpgp.c (struct keyparm_s): New.
    (keygrip_from_keyparm): New.
    (parse_key): Compute keygrip.
    * kbx/keybox-search.c (blob_openpgp_has_grip): New.
    (has_keygrip): Call it.
    --
    
    This has been marked for too long as not yet working.  However, it is
    a pretty useful feature and will come pretty handy when looking for
    all keys matching one keygrip.
    
    Can be optimized a lot by storing the keygrip in the meta data.  This
    will be done along with the upgrade of KBX for v5 fingerprints.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/specify-user-id.texi b/doc/specify-user-id.texi
index b363c2a..64e354b 100644
--- a/doc/specify-user-id.texi
+++ b/doc/specify-user-id.texi
@@ -135,7 +135,7 @@ RFC-2253 encoded DN of the issuer. See note above.
 @item By keygrip.
 This is indicated by an ampersand followed by the 40 hex digits of a
 keygrip.  @command{gpgsm} prints the keygrip when using the command
- at option{--dump-cert}.  It does not yet work for OpenPGP keys.
+ at option{--dump-cert}.
 
 @cartouche
 @example
@@ -171,6 +171,3 @@ Using the RFC-2253 format of DNs has the drawback that it is not
 possible to map them back to the original encoding, however we don't
 have to do this because our key database stores this encoding as meta
 data.
-
-
-
diff --git a/kbx/kbxutil.c b/kbx/kbxutil.c
index 2cfd070..35f92ab 100644
--- a/kbx/kbxutil.c
+++ b/kbx/kbxutil.c
@@ -330,6 +330,18 @@ dump_fpr (const unsigned char *buffer, size_t len)
 
 
 static void
+dump_grip (const unsigned char *buffer, size_t len)
+{
+  int i;
+
+  for (i=0; i < len; i++, buffer++)
+    {
+      printf ("%02X", buffer[0]);
+    }
+}
+
+
+static void
 dump_openpgp_key (keybox_openpgp_info_t info, const unsigned char *image)
 {
   printf ("pub %2d %02X%02X%02X%02X",
@@ -338,6 +350,9 @@ dump_openpgp_key (keybox_openpgp_info_t info, const unsigned char *image)
           info->primary.keyid[6], info->primary.keyid[7] );
   dump_fpr (info->primary.fpr, info->primary.fprlen);
   putchar ('\n');
+  fputs ("grp             ", stdout);
+  dump_grip (info->primary.grip, 20);
+  putchar ('\n');
   if (info->nsubkeys)
     {
       struct _keybox_openpgp_key_info *k;
@@ -351,6 +366,9 @@ dump_openpgp_key (keybox_openpgp_info_t info, const unsigned char *image)
                   k->keyid[6], k->keyid[7] );
           dump_fpr (k->fpr, k->fprlen);
           putchar ('\n');
+          fputs ("grp             ", stdout);
+          dump_grip (k->grip, 20);
+          putchar ('\n');
           k = k->next;
         }
       while (k);
diff --git a/kbx/keybox-defs.h b/kbx/keybox-defs.h
index be2dd72..d2b79ba 100644
--- a/kbx/keybox-defs.h
+++ b/kbx/keybox-defs.h
@@ -94,11 +94,12 @@ struct keybox_handle {
 };
 
 
-/* Openpgp helper structures. */
+/* OpenPGP helper structures.  */
 struct _keybox_openpgp_key_info
 {
   struct _keybox_openpgp_key_info *next;
   int algo;
+  unsigned char grip[20];
   unsigned char keyid[8];
   int fprlen;  /* Either 16 or 20 */
   unsigned char fpr[20];
diff --git a/kbx/keybox-openpgp.c b/kbx/keybox-openpgp.c
index 0ba0b9a..6d6ed77 100644
--- a/kbx/keybox-openpgp.c
+++ b/kbx/keybox-openpgp.c
@@ -38,6 +38,13 @@
 #include "../common/openpgpdefs.h"
 #include "../common/host2net.h"
 
+struct keyparm_s
+{
+  const char *mpi;
+  int len;   /* int to avoid a cast in gcry_sexp_build.  */
+};
+
+
 /* Assume a valid OpenPGP packet at the address pointed to by BUFBTR
    which has a maximum length as stored at BUFLEN.  Return the header
    information of that packet and advance the pointer stored at BUFPTR
@@ -165,6 +172,86 @@ next_packet (unsigned char const **bufptr, size_t *buflen,
 }
 
 
+/* Take a list of key parameters KP for the OpenPGP ALGO and compute
+ * the keygrip which will be stored at GRIP.  GRIP needs to be a
+ * buffer of 20 bytes.  */
+static gpg_error_t
+keygrip_from_keyparm (int algo, struct keyparm_s *kp, unsigned char *grip)
+{
+  gpg_error_t err;
+  gcry_sexp_t s_pkey = NULL;
+
+  switch (algo)
+    {
+    case PUBKEY_ALGO_DSA:
+      err = gcry_sexp_build (&s_pkey, NULL,
+                             "(public-key(dsa(p%b)(q%b)(g%b)(y%b)))",
+                             kp[0].len, kp[0].mpi,
+                             kp[1].len, kp[1].mpi,
+                             kp[2].len, kp[2].mpi,
+                             kp[3].len, kp[3].mpi);
+      break;
+
+    case PUBKEY_ALGO_ELGAMAL:
+    case PUBKEY_ALGO_ELGAMAL_E:
+      err = gcry_sexp_build (&s_pkey, NULL,
+                             "(public-key(elg(p%b)(g%b)(y%b)))",
+                             kp[0].len, kp[0].mpi,
+                             kp[1].len, kp[1].mpi,
+                             kp[2].len, kp[2].mpi);
+      break;
+
+    case PUBKEY_ALGO_RSA:
+    case PUBKEY_ALGO_RSA_S:
+    case PUBKEY_ALGO_RSA_E:
+      err = gcry_sexp_build (&s_pkey, NULL,
+                             "(public-key(rsa(n%b)(e%b)))",
+                             kp[0].len, kp[0].mpi,
+                             kp[1].len, kp[1].mpi);
+      break;
+
+    case PUBKEY_ALGO_EDDSA:
+    case PUBKEY_ALGO_ECDSA:
+    case PUBKEY_ALGO_ECDH:
+      {
+        char *curve = openpgp_oidbuf_to_str (kp[0].mpi, kp[0].len);
+        if (!curve)
+          err = gpg_error_from_syserror ();
+        else
+          {
+            err = gcry_sexp_build
+              (&s_pkey, NULL,
+               (algo == PUBKEY_ALGO_EDDSA)?
+               "(public-key(ecc(curve%s)(flags eddsa)(q%b)))":
+               (algo == PUBKEY_ALGO_ECDH
+                && openpgp_oidbuf_is_cv25519 (kp[0].mpi, kp[0].len))?
+               "(public-key(ecc(curve%s)(flags djb-tweak)(q%b)))":
+               "(public-key(ecc(curve%s)(q%b)))",
+               curve, kp[1].len, kp[1].mpi);
+            xfree (curve);
+          }
+      }
+      break;
+
+    default:
+      err = gpg_error (GPG_ERR_PUBKEY_ALGO);
+      break;
+    }
+
+  if (!err && !gcry_pk_get_keygrip (s_pkey, grip))
+    {
+      log_info ("kbx: error computing keygrip\n");
+      err = gpg_error (GPG_ERR_GENERAL);
+    }
+
+  gcry_sexp_release (s_pkey);
+
+  if (err)
+    memset (grip, 0, 20);
+  return err;
+}
+
+
 /* Parse a key packet and store the information in KI. */
 static gpg_error_t
 parse_key (const unsigned char *data, size_t datalen,
@@ -176,10 +263,10 @@ parse_key (const unsigned char *data, size_t datalen,
   size_t n;
   int npkey;
   unsigned char hashbuffer[768];
-  const unsigned char *mpi_n = NULL;
-  size_t mpi_n_len = 0, mpi_e_len = 0;
   gcry_md_hd_t md;
   int is_ecc = 0;
+  struct keyparm_s keyparm[OPENPGP_MAX_NPKEY];
+  unsigned char *helpmpibuf[OPENPGP_MAX_NPKEY] = { NULL };
 
   if (datalen < 5)
     return gpg_error (GPG_ERR_INV_PACKET);
@@ -245,6 +332,9 @@ parse_key (const unsigned char *data, size_t datalen,
           nbytes++; /* The size byte itself.  */
           if (datalen < nbytes)
             return gpg_error (GPG_ERR_INV_PACKET);
+
+          keyparm[i].mpi = data;
+          keyparm[i].len = nbytes;
         }
       else
         {
@@ -254,21 +344,40 @@ parse_key (const unsigned char *data, size_t datalen,
           nbytes = (nbits+7) / 8;
           if (datalen < nbytes)
             return gpg_error (GPG_ERR_INV_PACKET);
-          /* For use by v3 fingerprint calculation we need to know the RSA
-             modulus and exponent. */
-          if (i==0)
-            {
-              mpi_n = data;
-              mpi_n_len = nbytes;
-            }
-          else if (i==1)
-            mpi_e_len = nbytes;
+
+          keyparm[i].mpi = data;
+          keyparm[i].len = nbytes;
         }
 
       data += nbytes; datalen -= nbytes;
     }
   n = data - data_start;
 
+
+  /* Note: Starting here we need to jump to leave on error. */
+
+  /* Make sure the MPIs are unsigned.  */
+  for (i=0; i < npkey; i++)
+    {
+      if (!keyparm[i].len || (keyparm[i].mpi[0] & 0x80))
+        {
+          helpmpibuf[i] = xtrymalloc (1+keyparm[i].len);
+          if (!helpmpibuf[i])
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
+          helpmpibuf[i][0] = 0;
+          memcpy (helpmpibuf[i]+1, keyparm[i].mpi, keyparm[i].len);
+          keyparm[i].mpi = helpmpibuf[i];
+          keyparm[i].len++;
+        }
+    }
+
+  err = keygrip_from_keyparm (algorithm, keyparm, ki->grip);
+  if (err)
+    goto leave;
+
   if (version < 4)
     {
       /* We do not support any other algorithm than RSA in v3
@@ -279,20 +388,20 @@ parse_key (const unsigned char *data, size_t datalen,
       err = gcry_md_open (&md, GCRY_MD_MD5, 0);
       if (err)
         return err; /* Oops */
-      gcry_md_write (md, mpi_n, mpi_n_len);
-      gcry_md_write (md, mpi_n+mpi_n_len+2, mpi_e_len);
+      gcry_md_write (md, keyparm[0].mpi, keyparm[0].len);
+      gcry_md_write (md, keyparm[1].mpi, keyparm[1].len);
       memcpy (ki->fpr, gcry_md_read (md, 0), 16);
       gcry_md_close (md);
       ki->fprlen = 16;
 
-      if (mpi_n_len < 8)
+      if (keyparm[0].len < 8)
         {
           /* Moduli less than 64 bit are out of the specs scope.  Zero
              them out because this is what gpg does too. */
           memset (ki->keyid, 0, 8);
         }
       else
-        memcpy (ki->keyid, mpi_n + mpi_n_len - 8, 8);
+        memcpy (ki->keyid, keyparm[0].mpi + keyparm[0].len - 8, 8);
     }
   else
     {
@@ -327,7 +436,11 @@ parse_key (const unsigned char *data, size_t datalen,
       memcpy (ki->keyid, ki->fpr+12, 8);
     }
 
-  return 0;
+ leave:
+  for (i=0; i < npkey; i++)
+    xfree (helpmpibuf[i]);
+
+  return err;
 }
 
 
diff --git a/kbx/keybox-search.c b/kbx/keybox-search.c
index 0a050ff..946ef52 100644
--- a/kbx/keybox-search.c
+++ b/kbx/keybox-search.c
@@ -497,6 +497,58 @@ blob_cmp_mail (KEYBOXBLOB blob, const char *name, size_t namelen, int substr,
 }
 
 
+/* Return true if the key in BLOB matches the 20 bytes keygrip GRIP.
+ * We don't have the keygrips as meta data, thus we need to parse the
+ * certificate. Fixme: We might want to return proper error codes
+ * instead of failing a search for invalid certificates etc.  */
+static int
+blob_openpgp_has_grip (KEYBOXBLOB blob, const unsigned char *grip)
+{
+  int rc = 0;
+  const unsigned char *buffer;
+  size_t length;
+  size_t cert_off, cert_len;
+  struct _keybox_openpgp_info info;
+  struct _keybox_openpgp_key_info *k;
+
+  buffer = _keybox_get_blob_image (blob, &length);
+  if (length < 40)
+    return 0; /* Too short. */
+  cert_off = get32 (buffer+8);
+  cert_len = get32 (buffer+12);
+  if ((uint64_t)cert_off+(uint64_t)cert_len > (uint64_t)length)
+    return 0; /* Too short.  */
+
+  if (_keybox_parse_openpgp (buffer + cert_off, cert_len, NULL, &info))
+    return 0; /* Parse error.  */
+
+  if (!memcmp (info.primary.grip, grip, 20))
+    {
+      rc = 1;
+      goto leave;
+    }
+
+  if (info.nsubkeys)
+    {
+      k = &info.subkeys;
+      do
+        {
+          if (!memcmp (k->grip, grip, 20))
+            {
+              rc = 1;
+              goto leave;
+            }
+          k = k->next;
+        }
+      while (k);
+    }
+
+ leave:
+  _keybox_destroy_openpgp_info (&info);
+  return rc;
+}
+
+
 #ifdef KEYBOX_WITH_X509
 /* Return true if the key in BLOB matches the 20 bytes keygrip GRIP.
    We don't have the keygrips as meta data, thus we need to parse the
@@ -606,12 +658,11 @@ has_fingerprint (KEYBOXBLOB blob, const unsigned char *fpr)
 static inline int
 has_keygrip (KEYBOXBLOB blob, const unsigned char *grip)
 {
+  if (blob_get_type (blob) == KEYBOX_BLOBTYPE_PGP)
+    return blob_openpgp_has_grip (blob, grip);
 #ifdef KEYBOX_WITH_X509
   if (blob_get_type (blob) == KEYBOX_BLOBTYPE_X509)
     return blob_x509_has_grip (blob, grip);
-#else
-  (void)blob;
-  (void)grip;
 #endif
   return 0;
 }

-----------------------------------------------------------------------

Summary of changes:
 doc/specify-user-id.texi |   5 +-
 kbx/kbxutil.c            |  18 ++++++
 kbx/keybox-defs.h        |   3 +-
 kbx/keybox-openpgp.c     | 145 +++++++++++++++++++++++++++++++++++++++++------
 kbx/keybox-search.c      |  57 ++++++++++++++++++-
 5 files changed, 204 insertions(+), 24 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 29 20:23:42 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 29 Jan 2019 20:23:42 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.2.12-16-g5e5f3ca
Message-ID: <E1goYz1-0007BY-RE@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  5e5f3ca0c2e08185a236b4d04b318f81004e3223 (commit)
       via  b78f293cf06f447d1d0a5c416ac129a4e1cf9f8c (commit)
       via  dddbb26155f292fde2909ecc84b62b693b6dea49 (commit)
      from  9fd6ba268f1fdf77cc5baa6e8fd3ab28e432e49b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5e5f3ca0c2e08185a236b4d04b318f81004e3223
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 19:52:08 2019 +0100

    gpg: Implement searching keys via keygrip.
    
    * kbx/keybox-defs.h (struct _keybox_openpgp_key_info): Add field grip.
    * kbx/keybox-openpgp.c (struct keyparm_s): New.
    (keygrip_from_keyparm): New.
    (parse_key): Compute keygrip.
    * kbx/keybox-search.c (blob_openpgp_has_grip): New.
    (has_keygrip): Call it.
    --
    
    This has been marked for too long as not yet working.  However, it is
    a pretty useful feature and will come pretty handy when looking for
    all keys matching one keygrip.
    
    Can be optimized a lot by storing the keygrip in the meta data.  This
    will be done along with the upgrade of KBX for v5 fingerprints.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit c128667b3cba749dd14262e032d4c260a2b0acd3)

diff --git a/doc/specify-user-id.texi b/doc/specify-user-id.texi
index b363c2a..64e354b 100644
--- a/doc/specify-user-id.texi
+++ b/doc/specify-user-id.texi
@@ -135,7 +135,7 @@ RFC-2253 encoded DN of the issuer. See note above.
 @item By keygrip.
 This is indicated by an ampersand followed by the 40 hex digits of a
 keygrip.  @command{gpgsm} prints the keygrip when using the command
- at option{--dump-cert}.  It does not yet work for OpenPGP keys.
+ at option{--dump-cert}.
 
 @cartouche
 @example
@@ -171,6 +171,3 @@ Using the RFC-2253 format of DNs has the drawback that it is not
 possible to map them back to the original encoding, however we don't
 have to do this because our key database stores this encoding as meta
 data.
-
-
-
diff --git a/kbx/kbxutil.c b/kbx/kbxutil.c
index 07774f2..f156122 100644
--- a/kbx/kbxutil.c
+++ b/kbx/kbxutil.c
@@ -330,6 +330,18 @@ dump_fpr (const unsigned char *buffer, size_t len)
 
 
 static void
+dump_grip (const unsigned char *buffer, size_t len)
+{
+  int i;
+
+  for (i=0; i < len; i++, buffer++)
+    {
+      printf ("%02X", buffer[0]);
+    }
+}
+
+
+static void
 dump_openpgp_key (keybox_openpgp_info_t info, const unsigned char *image)
 {
   printf ("pub %2d %02X%02X%02X%02X",
@@ -338,6 +350,9 @@ dump_openpgp_key (keybox_openpgp_info_t info, const unsigned char *image)
           info->primary.keyid[6], info->primary.keyid[7] );
   dump_fpr (info->primary.fpr, info->primary.fprlen);
   putchar ('\n');
+  fputs ("grp             ", stdout);
+  dump_grip (info->primary.grip, 20);
+  putchar ('\n');
   if (info->nsubkeys)
     {
       struct _keybox_openpgp_key_info *k;
@@ -351,6 +366,9 @@ dump_openpgp_key (keybox_openpgp_info_t info, const unsigned char *image)
                   k->keyid[6], k->keyid[7] );
           dump_fpr (k->fpr, k->fprlen);
           putchar ('\n');
+          fputs ("grp             ", stdout);
+          dump_grip (k->grip, 20);
+          putchar ('\n');
           k = k->next;
         }
       while (k);
diff --git a/kbx/keybox-defs.h b/kbx/keybox-defs.h
index be2dd72..d2b79ba 100644
--- a/kbx/keybox-defs.h
+++ b/kbx/keybox-defs.h
@@ -94,11 +94,12 @@ struct keybox_handle {
 };
 
 
-/* Openpgp helper structures. */
+/* OpenPGP helper structures.  */
 struct _keybox_openpgp_key_info
 {
   struct _keybox_openpgp_key_info *next;
   int algo;
+  unsigned char grip[20];
   unsigned char keyid[8];
   int fprlen;  /* Either 16 or 20 */
   unsigned char fpr[20];
diff --git a/kbx/keybox-openpgp.c b/kbx/keybox-openpgp.c
index 0ba0b9a..6d6ed77 100644
--- a/kbx/keybox-openpgp.c
+++ b/kbx/keybox-openpgp.c
@@ -38,6 +38,13 @@
 #include "../common/openpgpdefs.h"
 #include "../common/host2net.h"
 
+struct keyparm_s
+{
+  const char *mpi;
+  int len;   /* int to avoid a cast in gcry_sexp_build.  */
+};
+
+
 /* Assume a valid OpenPGP packet at the address pointed to by BUFBTR
    which has a maximum length as stored at BUFLEN.  Return the header
    information of that packet and advance the pointer stored at BUFPTR
@@ -165,6 +172,86 @@ next_packet (unsigned char const **bufptr, size_t *buflen,
 }
 
 
+/* Take a list of key parameters KP for the OpenPGP ALGO and compute
+ * the keygrip which will be stored at GRIP.  GRIP needs to be a
+ * buffer of 20 bytes.  */
+static gpg_error_t
+keygrip_from_keyparm (int algo, struct keyparm_s *kp, unsigned char *grip)
+{
+  gpg_error_t err;
+  gcry_sexp_t s_pkey = NULL;
+
+  switch (algo)
+    {
+    case PUBKEY_ALGO_DSA:
+      err = gcry_sexp_build (&s_pkey, NULL,
+                             "(public-key(dsa(p%b)(q%b)(g%b)(y%b)))",
+                             kp[0].len, kp[0].mpi,
+                             kp[1].len, kp[1].mpi,
+                             kp[2].len, kp[2].mpi,
+                             kp[3].len, kp[3].mpi);
+      break;
+
+    case PUBKEY_ALGO_ELGAMAL:
+    case PUBKEY_ALGO_ELGAMAL_E:
+      err = gcry_sexp_build (&s_pkey, NULL,
+                             "(public-key(elg(p%b)(g%b)(y%b)))",
+                             kp[0].len, kp[0].mpi,
+                             kp[1].len, kp[1].mpi,
+                             kp[2].len, kp[2].mpi);
+      break;
+
+    case PUBKEY_ALGO_RSA:
+    case PUBKEY_ALGO_RSA_S:
+    case PUBKEY_ALGO_RSA_E:
+      err = gcry_sexp_build (&s_pkey, NULL,
+                             "(public-key(rsa(n%b)(e%b)))",
+                             kp[0].len, kp[0].mpi,
+                             kp[1].len, kp[1].mpi);
+      break;
+
+    case PUBKEY_ALGO_EDDSA:
+    case PUBKEY_ALGO_ECDSA:
+    case PUBKEY_ALGO_ECDH:
+      {
+        char *curve = openpgp_oidbuf_to_str (kp[0].mpi, kp[0].len);
+        if (!curve)
+          err = gpg_error_from_syserror ();
+        else
+          {
+            err = gcry_sexp_build
+              (&s_pkey, NULL,
+               (algo == PUBKEY_ALGO_EDDSA)?
+               "(public-key(ecc(curve%s)(flags eddsa)(q%b)))":
+               (algo == PUBKEY_ALGO_ECDH
+                && openpgp_oidbuf_is_cv25519 (kp[0].mpi, kp[0].len))?
+               "(public-key(ecc(curve%s)(flags djb-tweak)(q%b)))":
+               "(public-key(ecc(curve%s)(q%b)))",
+               curve, kp[1].len, kp[1].mpi);
+            xfree (curve);
+          }
+      }
+      break;
+
+    default:
+      err = gpg_error (GPG_ERR_PUBKEY_ALGO);
+      break;
+    }
+
+  if (!err && !gcry_pk_get_keygrip (s_pkey, grip))
+    {
+      log_info ("kbx: error computing keygrip\n");
+      err = gpg_error (GPG_ERR_GENERAL);
+    }
+
+  gcry_sexp_release (s_pkey);
+
+  if (err)
+    memset (grip, 0, 20);
+  return err;
+}
+
+
 /* Parse a key packet and store the information in KI. */
 static gpg_error_t
 parse_key (const unsigned char *data, size_t datalen,
@@ -176,10 +263,10 @@ parse_key (const unsigned char *data, size_t datalen,
   size_t n;
   int npkey;
   unsigned char hashbuffer[768];
-  const unsigned char *mpi_n = NULL;
-  size_t mpi_n_len = 0, mpi_e_len = 0;
   gcry_md_hd_t md;
   int is_ecc = 0;
+  struct keyparm_s keyparm[OPENPGP_MAX_NPKEY];
+  unsigned char *helpmpibuf[OPENPGP_MAX_NPKEY] = { NULL };
 
   if (datalen < 5)
     return gpg_error (GPG_ERR_INV_PACKET);
@@ -245,6 +332,9 @@ parse_key (const unsigned char *data, size_t datalen,
           nbytes++; /* The size byte itself.  */
           if (datalen < nbytes)
             return gpg_error (GPG_ERR_INV_PACKET);
+
+          keyparm[i].mpi = data;
+          keyparm[i].len = nbytes;
         }
       else
         {
@@ -254,21 +344,40 @@ parse_key (const unsigned char *data, size_t datalen,
           nbytes = (nbits+7) / 8;
           if (datalen < nbytes)
             return gpg_error (GPG_ERR_INV_PACKET);
-          /* For use by v3 fingerprint calculation we need to know the RSA
-             modulus and exponent. */
-          if (i==0)
-            {
-              mpi_n = data;
-              mpi_n_len = nbytes;
-            }
-          else if (i==1)
-            mpi_e_len = nbytes;
+
+          keyparm[i].mpi = data;
+          keyparm[i].len = nbytes;
         }
 
       data += nbytes; datalen -= nbytes;
     }
   n = data - data_start;
 
+
+  /* Note: Starting here we need to jump to leave on error. */
+
+  /* Make sure the MPIs are unsigned.  */
+  for (i=0; i < npkey; i++)
+    {
+      if (!keyparm[i].len || (keyparm[i].mpi[0] & 0x80))
+        {
+          helpmpibuf[i] = xtrymalloc (1+keyparm[i].len);
+          if (!helpmpibuf[i])
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
+          helpmpibuf[i][0] = 0;
+          memcpy (helpmpibuf[i]+1, keyparm[i].mpi, keyparm[i].len);
+          keyparm[i].mpi = helpmpibuf[i];
+          keyparm[i].len++;
+        }
+    }
+
+  err = keygrip_from_keyparm (algorithm, keyparm, ki->grip);
+  if (err)
+    goto leave;
+
   if (version < 4)
     {
       /* We do not support any other algorithm than RSA in v3
@@ -279,20 +388,20 @@ parse_key (const unsigned char *data, size_t datalen,
       err = gcry_md_open (&md, GCRY_MD_MD5, 0);
       if (err)
         return err; /* Oops */
-      gcry_md_write (md, mpi_n, mpi_n_len);
-      gcry_md_write (md, mpi_n+mpi_n_len+2, mpi_e_len);
+      gcry_md_write (md, keyparm[0].mpi, keyparm[0].len);
+      gcry_md_write (md, keyparm[1].mpi, keyparm[1].len);
       memcpy (ki->fpr, gcry_md_read (md, 0), 16);
       gcry_md_close (md);
       ki->fprlen = 16;
 
-      if (mpi_n_len < 8)
+      if (keyparm[0].len < 8)
         {
           /* Moduli less than 64 bit are out of the specs scope.  Zero
              them out because this is what gpg does too. */
           memset (ki->keyid, 0, 8);
         }
       else
-        memcpy (ki->keyid, mpi_n + mpi_n_len - 8, 8);
+        memcpy (ki->keyid, keyparm[0].mpi + keyparm[0].len - 8, 8);
     }
   else
     {
@@ -327,7 +436,11 @@ parse_key (const unsigned char *data, size_t datalen,
       memcpy (ki->keyid, ki->fpr+12, 8);
     }
 
-  return 0;
+ leave:
+  for (i=0; i < npkey; i++)
+    xfree (helpmpibuf[i]);
+
+  return err;
 }
 
 
diff --git a/kbx/keybox-search.c b/kbx/keybox-search.c
index e309cce..1f5dbdf 100644
--- a/kbx/keybox-search.c
+++ b/kbx/keybox-search.c
@@ -497,6 +497,58 @@ blob_cmp_mail (KEYBOXBLOB blob, const char *name, size_t namelen, int substr,
 }
 
 
+/* Return true if the key in BLOB matches the 20 bytes keygrip GRIP.
+ * We don't have the keygrips as meta data, thus we need to parse the
+ * certificate. Fixme: We might want to return proper error codes
+ * instead of failing a search for invalid certificates etc.  */
+static int
+blob_openpgp_has_grip (KEYBOXBLOB blob, const unsigned char *grip)
+{
+  int rc = 0;
+  const unsigned char *buffer;
+  size_t length;
+  size_t cert_off, cert_len;
+  struct _keybox_openpgp_info info;
+  struct _keybox_openpgp_key_info *k;
+
+  buffer = _keybox_get_blob_image (blob, &length);
+  if (length < 40)
+    return 0; /* Too short. */
+  cert_off = get32 (buffer+8);
+  cert_len = get32 (buffer+12);
+  if ((uint64_t)cert_off+(uint64_t)cert_len > (uint64_t)length)
+    return 0; /* Too short.  */
+
+  if (_keybox_parse_openpgp (buffer + cert_off, cert_len, NULL, &info))
+    return 0; /* Parse error.  */
+
+  if (!memcmp (info.primary.grip, grip, 20))
+    {
+      rc = 1;
+      goto leave;
+    }
+
+  if (info.nsubkeys)
+    {
+      k = &info.subkeys;
+      do
+        {
+          if (!memcmp (k->grip, grip, 20))
+            {
+              rc = 1;
+              goto leave;
+            }
+          k = k->next;
+        }
+      while (k);
+    }
+
+ leave:
+  _keybox_destroy_openpgp_info (&info);
+  return rc;
+}
+
+
 #ifdef KEYBOX_WITH_X509
 /* Return true if the key in BLOB matches the 20 bytes keygrip GRIP.
    We don't have the keygrips as meta data, thus we need to parse the
@@ -606,12 +658,11 @@ has_fingerprint (KEYBOXBLOB blob, const unsigned char *fpr)
 static inline int
 has_keygrip (KEYBOXBLOB blob, const unsigned char *grip)
 {
+  if (blob_get_type (blob) == KEYBOX_BLOBTYPE_PGP)
+    return blob_openpgp_has_grip (blob, grip);
 #ifdef KEYBOX_WITH_X509
   if (blob_get_type (blob) == KEYBOX_BLOBTYPE_X509)
     return blob_x509_has_grip (blob, grip);
-#else
-  (void)blob;
-  (void)grip;
 #endif
   return 0;
 }

commit b78f293cf06f447d1d0a5c416ac129a4e1cf9f8c
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 18:20:34 2019 +0100

    common: Provide some convenient OpenPGP related constants.
    
    * common/openpgpdefs.h (OPENPGP_MAX_NPKEY): New.
    (OPENPGP_MAX_NSKEY): New.
    (OPENPGP_MAX_NSIG): New.
    (OPENPGP_MAX_NENC): New.
    * g10/packet.h: Define PUBKEY_MAX using the new consts.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit f382984966a31a4cbe572bce5370590c5490ed1e)

diff --git a/common/openpgpdefs.h b/common/openpgpdefs.h
index 85a4251..73776b3 100644
--- a/common/openpgpdefs.h
+++ b/common/openpgpdefs.h
@@ -184,5 +184,11 @@ typedef enum
   }
 compress_algo_t;
 
+/* Limits to be used for static arrays.  */
+#define OPENPGP_MAX_NPKEY  5  /* Maximum number of public key parameters. */
+#define OPENPGP_MAX_NSKEY  7  /* Maximum number of secret key parameters. */
+#define OPENPGP_MAX_NSIG   2  /* Maximum number of signature parameters.  */
+#define OPENPGP_MAX_NENC   2  /* Maximum number of encryption parameters. */
+
 
 #endif /*GNUPG_COMMON_OPENPGPDEFS_H*/
diff --git a/g10/packet.h b/g10/packet.h
index 6d01b10..d273bb3 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -34,11 +34,11 @@
 #define DEBUG_PARSE_PACKET 1
 
 
-/* Constants to allocate static MPI arrays. */
-#define PUBKEY_MAX_NPKEY  5
-#define PUBKEY_MAX_NSKEY  7
-#define PUBKEY_MAX_NSIG   2
-#define PUBKEY_MAX_NENC   2
+/* Constants to allocate static MPI arrays.  */
+#define PUBKEY_MAX_NPKEY  OPENPGP_MAX_NPKEY
+#define PUBKEY_MAX_NSKEY  OPENPGP_MAX_NSKEY
+#define PUBKEY_MAX_NSIG   OPENPGP_MAX_NSIG
+#define PUBKEY_MAX_NENC   OPENPGP_MAX_NENC
 
 /* Usage flags */
 #define PUBKEY_USAGE_SIG     GCRY_PK_USAGE_SIGN  /* Good for signatures. */

commit dddbb26155f292fde2909ecc84b62b693b6dea49
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 18:19:05 2019 +0100

    common: New helper functions for OpenPGP curve OIDs.
    
    * common/openpgp-oid.c (openpgp_oidbuf_to_str): Factor most code out
    to ...
    (openpgp_oidbuf_to_str): new.
    (openpgp_oidbuf_is_ed25519): New.
    (openpgp_oidbuf_is_cv25519): New.
    --
    
    At some places it is more convenient (and faster) to directly work on
    buffers and avoid the way via opaque MPIs.  These 3 new functions
    allow for that.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit 4a1558d0c7190cf13d35385e47291a7aa121be3e)

diff --git a/common/openpgp-oid.c b/common/openpgp-oid.c
index d800e7d..18c5710 100644
--- a/common/openpgp-oid.c
+++ b/common/openpgp-oid.c
@@ -184,48 +184,36 @@ openpgp_oid_from_str (const char *string, gcry_mpi_t *r_mpi)
 }
 
 
-/* Return a malloced string represenation of the OID in the opaque MPI
-   A.  In case of an error NULL is returned and ERRNO is set.  */
+/* Return a malloced string representation of the OID in the buffer
+ * (BUF,LEN).  In case of an error NULL is returned and ERRNO is set.
+ * As per OpenPGP spec the first byte of the buffer is the length of
+ * the rest; the function performs a consistency check.  */
 char *
-openpgp_oid_to_str (gcry_mpi_t a)
+openpgp_oidbuf_to_str (const unsigned char *buf, size_t len)
 {
-  const unsigned char *buf;
-  size_t length;
-  unsigned int lengthi;
   char *string, *p;
   int n = 0;
   unsigned long val, valmask;
 
   valmask = (unsigned long)0xfe << (8 * (sizeof (valmask) - 1));
-
-  if (!a
-      || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE)
-      || !(buf = gcry_mpi_get_opaque (a, &lengthi)))
-    {
-      gpg_err_set_errno (EINVAL);
-      return NULL;
-    }
-
-  buf = gcry_mpi_get_opaque (a, &lengthi);
-  length = (lengthi+7)/8;
-
   /* The first bytes gives the length; check consistency.  */
-  if (!length || buf[0] != length -1)
+
+  if (!len || buf[0] != len -1)
     {
       gpg_err_set_errno (EINVAL);
       return NULL;
     }
   /* Skip length byte.  */
-  length--;
+  len--;
   buf++;
 
   /* To calculate the length of the string we can safely assume an
      upper limit of 3 decimal characters per byte.  Two extra bytes
      account for the special first octect */
-  string = p = xtrymalloc (length*(1+3)+2+1);
+  string = p = xtrymalloc (len*(1+3)+2+1);
   if (!string)
     return NULL;
-  if (!length)
+  if (!len)
     {
       *p = 0;
       return string;
@@ -237,7 +225,7 @@ openpgp_oid_to_str (gcry_mpi_t a)
     p += sprintf (p, "1.%d", buf[n]-40);
   else {
     val = buf[n] & 0x7f;
-    while ( (buf[n]&0x80) && ++n < length )
+    while ( (buf[n]&0x80) && ++n < len )
       {
         if ( (val & valmask) )
           goto badoid;  /* Overflow.  */
@@ -250,10 +238,10 @@ openpgp_oid_to_str (gcry_mpi_t a)
     sprintf (p, "2.%lu", val);
     p += strlen (p);
   }
-  for (n++; n < length; n++)
+  for (n++; n < len; n++)
     {
       val = buf[n] & 0x7f;
-      while ( (buf[n]&0x80) && ++n < length )
+      while ( (buf[n]&0x80) && ++n < len )
         {
           if ( (val & valmask) )
             goto badoid;  /* Overflow.  */
@@ -278,6 +266,35 @@ openpgp_oid_to_str (gcry_mpi_t a)
 }
 
 
+/* Return a malloced string representation of the OID in the opaque
+ * MPI A.  In case of an error NULL is returned and ERRNO is set.  */
+char *
+openpgp_oid_to_str (gcry_mpi_t a)
+{
+  const unsigned char *buf;
+  unsigned int lengthi;
+
+  if (!a
+      || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE)
+      || !(buf = gcry_mpi_get_opaque (a, &lengthi)))
+    {
+      gpg_err_set_errno (EINVAL);
+      return NULL;
+    }
+
+  buf = gcry_mpi_get_opaque (a, &lengthi);
+  return openpgp_oidbuf_to_str (buf, (lengthi+7)/8);
+}
+
+
+/* Return true if (BUF,LEN) represents the OID for Ed25519.  */
+int
+openpgp_oidbuf_is_ed25519 (const void *buf, size_t len)
+{
+  return (buf && len == DIM (oid_ed25519)
+          && !memcmp (buf, oid_ed25519, DIM (oid_ed25519)));
+}
+
 
 /* Return true if A represents the OID for Ed25519.  */
 int
@@ -285,32 +302,36 @@ openpgp_oid_is_ed25519 (gcry_mpi_t a)
 {
   const unsigned char *buf;
   unsigned int nbits;
-  size_t n;
 
   if (!a || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
     return 0;
 
   buf = gcry_mpi_get_opaque (a, &nbits);
-  n = (nbits+7)/8;
-  return (n == DIM (oid_ed25519)
-          && !memcmp (buf, oid_ed25519, DIM (oid_ed25519)));
+  return openpgp_oidbuf_is_ed25519 (buf, (nbits+7)/8);
 }
 
 
+/* Return true if (BUF,LEN) represents the OID for Curve25519.  */
+int
+openpgp_oidbuf_is_cv25519 (const void *buf, size_t len)
+{
+  return (buf && len == DIM (oid_cv25519)
+          && !memcmp (buf, oid_cv25519, DIM (oid_cv25519)));
+}
+
+
+/* Return true if the MPI A represents the OID for Curve25519.  */
 int
 openpgp_oid_is_cv25519 (gcry_mpi_t a)
 {
   const unsigned char *buf;
   unsigned int nbits;
-  size_t n;
 
   if (!a || !gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
     return 0;
 
   buf = gcry_mpi_get_opaque (a, &nbits);
-  n = (nbits+7)/8;
-  return (n == DIM (oid_cv25519)
-          && !memcmp (buf, oid_cv25519, DIM (oid_cv25519)));
+  return openpgp_oidbuf_is_cv25519 (buf, (nbits+7)/8);
 }
 
 
diff --git a/common/t-openpgp-oid.c b/common/t-openpgp-oid.c
index cb5709d..fd9de5d 100644
--- a/common/t-openpgp-oid.c
+++ b/common/t-openpgp-oid.c
@@ -142,7 +142,15 @@ test_openpgp_oid_to_str (void)
         fail (idx, 0);
       xfree (string);
       gcry_mpi_release (a);
-    }
+
+      /* Again using the buffer variant. */
+      string = openpgp_oidbuf_to_str (samples[idx].der, samples[idx].der[0]+1);
+      if (!string)
+        fail (idx, gpg_error_from_syserror ());
+      if (strcmp (string, samples[idx].string))
+        fail (idx, 0);
+      xfree (string);
+}
 
 }
 
diff --git a/common/util.h b/common/util.h
index c6d19c6..36f1b93 100644
--- a/common/util.h
+++ b/common/util.h
@@ -219,8 +219,11 @@ size_t percent_unescape_inplace (char *string, int nulrepl);
 
 /*-- openpgp-oid.c --*/
 gpg_error_t openpgp_oid_from_str (const char *string, gcry_mpi_t *r_mpi);
+char *openpgp_oidbuf_to_str (const unsigned char *buf, size_t len);
 char *openpgp_oid_to_str (gcry_mpi_t a);
+int openpgp_oidbuf_is_ed25519 (const void *buf, size_t len);
 int openpgp_oid_is_ed25519 (gcry_mpi_t a);
+int openpgp_oidbuf_is_cv25519 (const void *buf, size_t len);
 int openpgp_oid_is_cv25519 (gcry_mpi_t a);
 const char *openpgp_curve_to_oid (const char *name, unsigned int *r_nbits);
 const char *openpgp_oid_to_curve (const char *oid, int canon);

-----------------------------------------------------------------------

Summary of changes:
 common/openpgp-oid.c     |  87 +++++++++++++++++-----------
 common/openpgpdefs.h     |   6 ++
 common/t-openpgp-oid.c   |  10 +++-
 common/util.h            |   3 +
 doc/specify-user-id.texi |   5 +-
 g10/packet.h             |  10 ++--
 kbx/kbxutil.c            |  18 ++++++
 kbx/keybox-defs.h        |   3 +-
 kbx/keybox-openpgp.c     | 145 +++++++++++++++++++++++++++++++++++++++++------
 kbx/keybox-search.c      |  57 ++++++++++++++++++-
 10 files changed, 281 insertions(+), 63 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 29 22:16:03 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 29 Jan 2019 22:16:03 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-342-gdee0138
Message-ID: <E1goajl-0001Vo-6K@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  dee0138dc022c7113309087736312d2451adf115 (commit)
      from  c128667b3cba749dd14262e032d4c260a2b0acd3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dee0138dc022c7113309087736312d2451adf115
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 29 22:15:49 2019 +0100

    doc: Fix typo
    
    --

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 6b6c8cc..e6829b9 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3310,7 +3310,7 @@ command has the same effect as using @option{--list-keys} with
 @option{--with-sig-list}.  Note that in contrast to
 @option{--check-signatures} the key signatures are not verified.  This
 command can be used to create a list of signing keys missing in the
-lcoal keyring; for example:
+local keyring; for example:
 
 @example
       gpg --list-sigs --with-colons USERID | \

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 11:28:35 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 30 Jan 2019 11:28:35 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-344-g346a98f
Message-ID: <E1gon6j-0000XH-Vt@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  346a98fabe03adf2e202e36fc2aa24b1c2571154 (commit)
       via  6ecedd0b25b6b1a33be63b99f2a8256370000521 (commit)
      from  dee0138dc022c7113309087736312d2451adf115 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 346a98fabe03adf2e202e36fc2aa24b1c2571154
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 11:28:14 2019 +0100

    gpg: Allow generating Ed25519 key from an existing key.
    
    * g10/misc.c (map_pk_gcry_to_openpgp): Add EdDSA mapping.
    --
    
    Due to this missing mapping a "gpg --export --full-gen-key" with
    selection "13 - Existing key" did not worked for an ed25519 key.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/misc.c b/g10/misc.c
index a3f0c67..0541d2b 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -513,6 +513,7 @@ map_pk_gcry_to_openpgp (enum gcry_pk_algos algo)
 {
   switch (algo)
     {
+    case GCRY_PK_EDDSA:  return PUBKEY_ALGO_EDDSA;
     case GCRY_PK_ECDSA:  return PUBKEY_ALGO_ECDSA;
     case GCRY_PK_ECDH:   return PUBKEY_ALGO_ECDH;
     default: return algo < 110 ? (pubkey_algo_t)algo : 0;

commit 6ecedd0b25b6b1a33be63b99f2a8256370000521
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 08:28:56 2019 +0100

    common: New function decode_c_string.
    
    * common/miscellaneous.c (decode_c_string): New.
    --
    
    This is basically a copy from the code we use in gpgme and gpa.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/miscellaneous.c b/common/miscellaneous.c
index 0b374e6..2605528 100644
--- a/common/miscellaneous.c
+++ b/common/miscellaneous.c
@@ -328,6 +328,82 @@ make_printable_string (const void *p, size_t n, int delim )
 }
 
 
+/* Decode the C formatted string SRC and return the result in a newly
+ * allocated buffer.  In error returns NULL and sets ERRNO. */
+char *
+decode_c_string (const char *src)
+{
+  char *buffer, *dst;
+  int val;
+
+  /* The converted string will never be larger than the original
+     string.  */
+  buffer = dst = xtrymalloc (strlen (src) + 1);
+  if (!buffer)
+    return NULL;
+
+  while (*src)
+    {
+      if (*src != '\\')
+	{
+	  *dst++ = *src++;
+	  continue;
+	}
+
+#define DECODE_ONE(_m,_r) case _m: src += 2; *dst++ = _r; break;
+
+      switch (src[1])
+	{
+	  DECODE_ONE ('n', '\n');
+	  DECODE_ONE ('r', '\r');
+	  DECODE_ONE ('f', '\f');
+	  DECODE_ONE ('v', '\v');
+	  DECODE_ONE ('b', '\b');
+	  DECODE_ONE ('t', '\t');
+	  DECODE_ONE ('\\', '\\');
+	  DECODE_ONE ('\'', '\'');
+	  DECODE_ONE ('\"', '\"');
+
+	case 'x':
+          val = hextobyte (src+2);
+          if (val == -1)  /* Bad coding, keep as is. */
+            {
+              *dst++ = *src++;
+              *dst++ = *src++;
+              if (*src)
+                *dst++ = *src++;
+              if (*src)
+                *dst++ = *src++;
+            }
+          else if (!val)
+            {
+              /* A binary zero is not representable in a C string thus
+               * we keep the C-escaping.  Note that this will also
+               * never be larger than the source string.  */
+              *dst++ = '\\';
+              *dst++ = '0';
+              src += 4;
+            }
+          else
+            {
+              *(unsigned char *)dst++ = val;
+              src += 4;
+            }
+	  break;
+
+	default: /* Bad coding; keep as is..  */
+          *dst++ = *src++;
+          *dst++ = *src++;
+          break;
+        }
+#undef DECODE_ONE
+    }
+  *dst++ = 0;
+
+  return buffer;
+}
+
+
 /* Check whether (BUF,LEN) is valid header for an OpenPGP compressed
  * packet.  LEN should be at least 6.  */
 static int
diff --git a/common/util.h b/common/util.h
index 8234b62..a4b1cbd 100644
--- a/common/util.h
+++ b/common/util.h
@@ -303,6 +303,7 @@ void print_hexstring (FILE *fp, const void *buffer, size_t length,
                       int reserved);
 char *try_make_printable_string (const void *p, size_t n, int delim);
 char *make_printable_string (const void *p, size_t n, int delim);
+char *decode_c_string (const char *src);
 
 int is_file_compressed (const char *s, int *ret_rc);
 

-----------------------------------------------------------------------

Summary of changes:
 common/miscellaneous.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++
 common/util.h          |  1 +
 g10/misc.c             |  1 +
 3 files changed, 78 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 11:29:15 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 30 Jan 2019 11:29:15 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.2.12-17-g31d2a1e
Message-ID: <E1gon7M-0000Yf-PD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  31d2a1eecaee766919b18bc42b918d9168f601f8 (commit)
      from  5e5f3ca0c2e08185a236b4d04b318f81004e3223 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 31d2a1eecaee766919b18bc42b918d9168f601f8
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 11:28:14 2019 +0100

    gpg: Allow generating Ed25519 key from an existing key.
    
    * g10/misc.c (map_pk_gcry_to_openpgp): Add EdDSA mapping.
    --
    
    Due to this missing mapping a "gpg --export --full-gen-key" with
    selection "13 - Existing key" did not worked for an ed25519 key.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>
    (cherry picked from commit 346a98fabe03adf2e202e36fc2aa24b1c2571154)

diff --git a/g10/misc.c b/g10/misc.c
index 7acf469..6d525a8 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -508,6 +508,7 @@ map_pk_gcry_to_openpgp (enum gcry_pk_algos algo)
 {
   switch (algo)
     {
+    case GCRY_PK_EDDSA:  return PUBKEY_ALGO_EDDSA;
     case GCRY_PK_ECDSA:  return PUBKEY_ALGO_ECDSA;
     case GCRY_PK_ECDH:   return PUBKEY_ALGO_ECDH;
     default: return algo < 110 ? (pubkey_algo_t)algo : 0;

-----------------------------------------------------------------------

Summary of changes:
 g10/misc.c | 1 +
 1 file changed, 1 insertion(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 14:40:44 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 30 Jan 2019 14:40:44 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-346-g140fda8
Message-ID: <E1goq6f-00021R-PS@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  140fda8c61422ec055c3f7e214cc35706c4320dd (commit)
       via  1fd3d864b4eceaf45b33e754e5d832b7ccc0d17f (commit)
      from  346a98fabe03adf2e202e36fc2aa24b1c2571154 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 140fda8c61422ec055c3f7e214cc35706c4320dd
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 14:40:26 2019 +0100

    gpg: Emit an ERROR status if no key was found with --list-keys.
    
    * g10/keylist.c (list_one): Emit status line.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keylist.c b/g10/keylist.c
index 0b8aa88..fffd95c 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -611,6 +611,7 @@ list_one (ctrl_t ctrl, strlist_t names, int secret, int mark_secret)
     {
       log_error ("error reading key: %s\n", gpg_strerror (rc));
       getkey_end (ctrl, ctx);
+      write_status_error ("keylist.getkey", rc);
       return;
     }
 

commit 1fd3d864b4eceaf45b33e754e5d832b7ccc0d17f
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 14:38:37 2019 +0100

    common: Add kludge to allow silencing gnupg_exec_tool_stream.
    
    * common/exectool.c (read_and_log_buffer_t): Take care of a --quiet
    argument.
    (gnupg_exec_tool_stream): Ditto.
    --
    
    If we pass --quiet to a program it should really shutup and the parent
    should be quite as well.

diff --git a/common/exectool.c b/common/exectool.c
index 3458de4..82b3985 100644
--- a/common/exectool.c
+++ b/common/exectool.c
@@ -53,6 +53,7 @@ typedef struct
   exec_tool_status_cb_t status_cb;
   void *status_cb_value;
   int cont;
+  int quiet;
   size_t used;
   size_t buffer_size;
   char *buffer;
@@ -110,6 +111,8 @@ read_and_log_stderr (read_and_log_buffer_t *state, es_poll_t *fderr)
               state->status_cb (state->status_cb_value,
                                 state->buffer + 9, rest);
             }
+          else if (state->quiet)
+            ;
           else if (!state->cont
               && !strncmp (state->buffer, pname, len)
               && strlen (state->buffer) > strlen (pname)
@@ -331,10 +334,16 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
   int count;
   read_and_log_buffer_t fderrstate;
   struct copy_buffer *cpbuf_in = NULL, *cpbuf_out = NULL, *cpbuf_extra = NULL;
+  int quiet = 0;
+  int dummy_exitcode;
 
   memset (fds, 0, sizeof fds);
   memset (&fderrstate, 0, sizeof fderrstate);
 
+  /* If the first argument to the program is "--quiet" avoid all extra
+   * diagnostics.  */
+  quiet = (argv && argv[0] && !strcmp (argv[0], "--quiet"));
+
   cpbuf_in = xtrymalloc (sizeof *cpbuf_in);
   if (cpbuf_in == NULL)
     {
@@ -360,6 +369,7 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
   copy_buffer_init (cpbuf_extra);
 
   fderrstate.pgmname = pgmname;
+  fderrstate.quiet = quiet;
   fderrstate.status_cb = status_cb;
   fderrstate.status_cb_value = status_cb_value;
   fderrstate.buffer_size = 256;
@@ -375,7 +385,7 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
       err = gnupg_create_outbound_pipe (extrapipe, &extrafp, 1);
       if (err)
         {
-          log_error ("error running outbound pipe for extra fp: %s\n",
+          log_error ("error creating outbound pipe for extra fp: %s\n",
                      gpg_strerror (err));
           goto leave;
         }
@@ -411,7 +421,8 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
     argv[argsaveidx] = argsave;
   if (err)
     {
-      log_error ("error running '%s': %s\n", pgmname, gpg_strerror (err));
+      if (!quiet)
+        log_error ("error running '%s': %s\n", pgmname, gpg_strerror (err));
       goto leave;
     }
 
@@ -535,7 +546,7 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
   es_fclose (outfp); outfp = NULL;
   es_fclose (errfp); errfp = NULL;
 
-  err = gnupg_wait_process (pgmname, pid, 1, NULL);
+  err = gnupg_wait_process (pgmname, pid, 1, quiet? &dummy_exitcode : NULL);
   pid = (pid_t)(-1);
 
  leave:
@@ -547,7 +558,7 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
   es_fclose (outfp);
   es_fclose (errfp);
   if (pid != (pid_t)(-1))
-    gnupg_wait_process (pgmname, pid, 1, NULL);
+    gnupg_wait_process (pgmname, pid, 1,  quiet? &dummy_exitcode : NULL);
   gnupg_release_process (pid);
 
   copy_buffer_shred (cpbuf_in);

-----------------------------------------------------------------------

Summary of changes:
 common/exectool.c | 19 +++++++++++++++----
 g10/keylist.c     |  1 +
 2 files changed, 16 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 15:01:49 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 30 Jan 2019 15:01:49 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-347-g833f27a
Message-ID: <E1goqR5-0001FM-1J@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  833f27a6a7e059e38bccaf360f05e72e4403545a (commit)
      from  140fda8c61422ec055c3f7e214cc35706c4320dd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 833f27a6a7e059e38bccaf360f05e72e4403545a
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 15:01:34 2019 +0100

    card: Print matching OpenPGP and X.509 data.
    
    * tools/card-tool-keys.c: New.
    * tools/Makefile.am (gpg_card_tool_SOURCES): Add file.
    * tools/card-tool.h (struct pubkey_s, pubkey_t): New.
    (struct userid_s, userid_t): New.
    (struct keyblock_s, keyblock_t): New.
    * common/util.h (GNUPG_PROTOCOL_): New const
    * tools/gpg-card-tool.c (aTest): Add temporary command.
    (list_one_kinfo): Print info from gpg and gpgsm.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/util.h b/common/util.h
index a4b1cbd..863f9e3 100644
--- a/common/util.h
+++ b/common/util.h
@@ -262,6 +262,13 @@ void gnupg_module_name_flush_some (void);
 void gnupg_set_builddir (const char *newdir);
 
 
+/* A list of constants to identify protocols.  This is used by tools
+ * which need to distinguish between the different protocols
+ * implemented by GnuPG.  May be used as bit flags.  */
+#define GNUPG_PROTOCOL_OPENPGP    1   /* The one and only (gpg).      */
+#define GNUPG_PROTOCOL_CMS        2   /* The core of S/MIME (gpgsm)   */
+#define GNUPG_PROTOCOL_SSH_AGENT  4   /* Out ssh-agent implementation */
+
 
 /*-- gpgrlhelp.c --*/
 void gnupg_rl_initialize (void);
diff --git a/tools/Makefile.am b/tools/Makefile.am
index f74221b..ad0f223 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -128,6 +128,7 @@ gpg_card_tool_SOURCES   = \
 	gpg-card-tool.c \
 	card-tool.h     \
 	card-call-scd.c \
+	card-tool-keys.c \
 	card-tool-misc.c
 
 gpg_card_tool_LDADD     = ../common/libgpgrl.a $(common_libs) \
diff --git a/tools/card-tool-keys.c b/tools/card-tool-keys.c
new file mode 100644
index 0000000..af2425c
--- /dev/null
+++ b/tools/card-tool-keys.c
@@ -0,0 +1,467 @@
+/* card-tool-keys.c - OpenPGP and CMS related functions for gpg-card-tool
+ * Copyright (C) 2019 g10 Code GmbH
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#include <config.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "../common/util.h"
+#include "../common/i18n.h"
+#include "../common/ccparray.h"
+#include "../common/exectool.h"
+#include "../common/openpgpdefs.h"
+#include "card-tool.h"
+
+/* Release a keyblocm object.  */
+void
+release_keyblock (keyblock_t keyblock)
+{
+  pubkey_t pubkey;
+  userid_t uid;
+
+  while (keyblock)
+    {
+      keyblock_t keyblocknext = keyblock->next;
+      pubkey = keyblock->keys;
+      while (pubkey)
+        {
+          pubkey_t pubkeynext = pubkey->next;
+          xfree (pubkey);
+          pubkey = pubkeynext;
+        }
+      uid = keyblock->uids;
+      while (uid)
+        {
+          userid_t uidnext = uid->next;
+          xfree (uid->value);
+          xfree (uid);
+          uid = uidnext;
+        }
+      xfree (keyblock);
+      keyblock = keyblocknext;
+    }
+}
+
+
+
+/* Object to communicate with the status_cb. */
+struct status_cb_s
+{
+  const char *pgm; /* Name of the program for debug purposes. */
+  int no_pubkey;   /* Result flag.  */
+};
+
+
+/* Status callback helper for the exec functions.  */
+static void
+status_cb (void *opaque, const char *keyword, char *args)
+{
+  struct status_cb_s *c = opaque;
+  const char *s;
+
+  if (DBG_EXTPROG)
+    log_debug ("%s: status: %s %s\n", c->pgm, keyword, args);
+
+  if (!strcmp (keyword, "ERROR")
+      && (s=has_leading_keyword (args, "keylist.getkey"))
+      && gpg_err_code (atoi (s)) == GPG_ERR_NO_PUBKEY)
+    {
+      /* No public key was found.  gpg terminates with an error in
+       * this case and we can't change that behaviour.  Instead we
+       * detect this status and carry that error forward. */
+      c->no_pubkey = 1;
+    }
+
+}
+
+
+/* Helper for get_matching_keys to parse "pub" style records.  */
+static gpg_error_t
+parse_key_record (char **fields, int nfields, pubkey_t *r_pubkey)
+{
+  pubkey_t pubkey;
+
+  pubkey = xtrycalloc (1, sizeof *pubkey);
+  if (!pubkey)
+    return gpg_error_from_syserror ();
+  *r_pubkey = pubkey;
+  return 0;
+}
+
+
+/* Run gpg or gpgsm to get a list of all keys matching the 20 byte
+ * KEYGRIP.  PROTOCOL is one of or a combination of
+ * GNUPG_PROTOCOL_OPENPGP and GNUPG_PROTOCOL_CMS.  On success a new
+ * keyblock is stored at R_KEYBLOCK; on error NULL is stored there. */
+gpg_error_t
+get_matching_keys (const unsigned char *keygrip, int protocol,
+                   keyblock_t *r_keyblock)
+{
+  gpg_error_t err;
+  ccparray_t ccp;
+  const char **argv;
+  estream_t listing;
+  char hexgrip[1 + (2*KEYGRIP_LEN) + 1];
+  char *line = NULL;
+  size_t length_of_line = 0;
+  size_t maxlen;
+  ssize_t len;
+  char **fields = NULL;
+  int nfields;
+  int first_seen;
+  keyblock_t keyblock_head, *keyblock_tail, kb;
+  pubkey_t pubkey, pk;
+  size_t n;
+  struct status_cb_s status_cb_parm;
+
+  *r_keyblock = NULL;
+
+  keyblock_head = NULL;
+  keyblock_tail = &keyblock_head;
+  kb = NULL;
+
+  /* Shortcut to run a listing on both protocols.  */
+  if ((protocol & GNUPG_PROTOCOL_OPENPGP) && (protocol & GNUPG_PROTOCOL_CMS))
+    {
+      err = get_matching_keys (keygrip, GNUPG_PROTOCOL_OPENPGP, &kb);
+      if (!err || gpg_err_code (err) == GPG_ERR_NO_PUBKEY)
+        {
+          *keyblock_tail = kb;
+          keyblock_tail = &kb->next;
+          kb = NULL;
+          err = get_matching_keys (keygrip, GNUPG_PROTOCOL_CMS, &kb);
+          if (!err)
+            {
+              *keyblock_tail = kb;
+              keyblock_tail = &kb->next;
+              kb = NULL;
+            }
+          else if (gpg_err_code (err) == GPG_ERR_NO_PUBKEY)
+            err = 0;
+        }
+      if (err)
+        release_keyblock (keyblock_head);
+      else
+        *r_keyblock = keyblock_head;
+      return err;
+    }
+
+  /* Check that we have only one protocol.  */
+  if (protocol != GNUPG_PROTOCOL_OPENPGP && protocol != GNUPG_PROTOCOL_CMS)
+    return gpg_error (GPG_ERR_UNSUPPORTED_PROTOCOL);
+
+  /* Open a memory stream.  */
+  listing = es_fopenmem (0, "w+b");
+  if (!listing)
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
+      return err;
+    }
+
+  status_cb_parm.pgm = protocol == GNUPG_PROTOCOL_OPENPGP? "gpg":"gpgsm";
+  status_cb_parm.no_pubkey = 0;
+
+  hexgrip[0] = '&';
+  bin2hex (keygrip, KEYGRIP_LEN, hexgrip+1);
+
+  ccparray_init (&ccp, 0);
+
+  if (opt.verbose > 1 || DBG_EXTPROG)
+    ccparray_put (&ccp, "--verbose");
+  else
+    ccparray_put (&ccp, "--quiet");
+  ccparray_put (&ccp, "--no-options");
+  ccparray_put (&ccp, "--batch");
+  ccparray_put (&ccp, "--status-fd=2");
+  ccparray_put (&ccp, "--with-colons");
+  ccparray_put (&ccp, "--with-keygrip");
+  ccparray_put (&ccp, "--list-keys");
+  ccparray_put (&ccp, hexgrip);
+
+  ccparray_put (&ccp, NULL);
+  argv = ccparray_get (&ccp, NULL);
+  if (!argv)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+  err = gnupg_exec_tool_stream (protocol == GNUPG_PROTOCOL_OPENPGP?
+                                opt.gpg_program : opt.gpgsm_program,
+                                argv, NULL, NULL, listing, status_cb,
+                                &status_cb_parm);
+  if (err)
+    {
+      if (status_cb_parm.no_pubkey)
+        err = gpg_error (GPG_ERR_NO_PUBKEY);
+      else if (gpg_err_code (err) != GPG_ERR_GENERAL)
+        log_error ("key listing failed: %s\n", gpg_strerror (err));
+      goto leave;
+    }
+
+  es_rewind (listing);
+  first_seen = 0;
+  maxlen = 8192; /* Set limit large enough for all escaped UIDs.  */
+  while ((len = es_read_line (listing, &line, &length_of_line, &maxlen)) > 0)
+    {
+      if (!maxlen)
+        {
+          log_error ("received line too long\n");
+          err = gpg_error (GPG_ERR_LINE_TOO_LONG);
+          goto leave;
+        }
+      /* Strip newline and carriage return, if present.  */
+      while (len > 0 && (line[len - 1] == '\n' || line[len - 1] == '\r'))
+	line[--len] = '\0';
+
+      xfree (fields);
+      fields = strtokenize (line, ":");
+      if (!fields)
+        {
+          err = gpg_error_from_syserror ();
+          log_error ("strtokenize failed: %s\n", gpg_strerror (err));
+          goto leave;
+        }
+      for (nfields = 0; fields[nfields]; nfields++)
+        ;
+      if (!nfields)
+        {
+          err = gpg_error (GPG_ERR_INV_ENGINE);
+          goto leave;
+        }
+
+      /* Skip over all records until we reach a pub or sec.  */
+      if (!first_seen
+          && (!strcmp (fields[0], "pub") || !strcmp (fields[0], "sec")
+              || !strcmp (fields[0], "crt") || !strcmp (fields[0], "crs")))
+        first_seen = 1;
+      if (!first_seen)
+        continue;
+
+      if (!strcmp (fields[0], "pub") || !strcmp (fields[0], "sec")
+          || !strcmp (fields[0], "crt") || !strcmp (fields[0], "crs"))
+        {
+          if (kb)  /* Finish the current keyblock.  */
+            {
+              *keyblock_tail = kb;
+              keyblock_tail = &kb->next;
+            }
+          kb = xtrycalloc (1, sizeof *kb);
+          if (!kb)
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
+          kb->protocol = protocol;
+          err = parse_key_record (fields, nfields, &pubkey);
+          if (err)
+            goto leave;
+          kb->keys = pubkey;
+          pubkey = NULL;
+        }
+      else if (!strcmp (fields[0], "sub") || !strcmp (fields[0], "ssb"))
+        {
+          log_assert (kb && kb->keys);
+          err = parse_key_record (fields, nfields, &pubkey);
+          if (err)
+            goto leave;
+          for (pk = kb->keys; pk->next; pk = pk->next)
+                ;
+          pk->next = pubkey;
+          pubkey = NULL;
+        }
+      else if (!strcmp (fields[0], "fpr") && nfields > 9)
+        {
+          log_assert (kb && kb->keys);
+          n = strlen (fields[9]);
+          if (n != 64 && n != 40 && n != 32)
+            {
+              log_debug ("bad length (%zu) in fpr record\n", n);
+              err = gpg_error (GPG_ERR_INV_ENGINE);
+              goto leave;
+            }
+          n /= 2;
+
+          for (pk = kb->keys; pk->next; pk = pk->next)
+            ;
+          if (pk->fprlen)
+            {
+              log_debug ("too many fpr records\n");
+              err = gpg_error (GPG_ERR_INV_ENGINE);
+              goto leave;
+            }
+          log_assert (n <= sizeof pk->fpr);
+          pk->fprlen = n;
+          if (hex2bin (fields[9], pk->fpr, n) < 0)
+            {
+              log_debug ("bad chars in fpr record\n");
+              err = gpg_error (GPG_ERR_INV_ENGINE);
+              goto leave;
+            }
+        }
+      else if (!strcmp (fields[0], "grp") && nfields > 9)
+        {
+          log_assert (kb && kb->keys);
+          n = strlen (fields[9]);
+          if (n != 2*KEYGRIP_LEN)
+            {
+              log_debug ("bad length (%zu) in grp record\n", n);
+              err = gpg_error (GPG_ERR_INV_ENGINE);
+              goto leave;
+            }
+          n /= 2;
+
+          for (pk = kb->keys; pk->next; pk = pk->next)
+            ;
+          if (pk->grip_valid)
+            {
+              log_debug ("too many grp records\n");
+              err = gpg_error (GPG_ERR_INV_ENGINE);
+              goto leave;
+            }
+          if (hex2bin (fields[9], pk->grip, KEYGRIP_LEN) < 0)
+            {
+              log_debug ("bad chars in fpr record\n");
+              err = gpg_error (GPG_ERR_INV_ENGINE);
+              goto leave;
+            }
+          pk->grip_valid = 1;
+          if (!memcmp (pk->grip, keygrip, KEYGRIP_LEN))
+            pk->requested = 1;
+        }
+      else if (!strcmp (fields[0], "uid") && nfields > 9)
+        {
+          userid_t uid, u;
+
+          uid = xtrycalloc (1, sizeof *uid);
+          if (!uid)
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
+          uid->value = decode_c_string (fields[9]);
+          if (!uid->value)
+            {
+              err = gpg_error_from_syserror ();
+              xfree (uid);
+              goto leave;
+            }
+          if (!kb->uids)
+            kb->uids = uid;
+          else
+            {
+              for (u = kb->uids; u->next; u = u->next)
+                ;
+              u->next = uid;
+            }
+        }
+    }
+  if (len < 0 || es_ferror (listing))
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error reading memory stream\n");
+      goto leave;
+    }
+
+  if (kb) /* Finish the current keyblock.  */
+    {
+      *keyblock_tail = kb;
+      keyblock_tail = &kb->next;
+      kb = NULL;
+    }
+
+  if (!keyblock_head)
+    err = gpg_error (GPG_ERR_NO_PUBKEY);
+
+ leave:
+  if (err)
+    release_keyblock (keyblock_head);
+  else
+    *r_keyblock = keyblock_head;
+  xfree (kb);
+  xfree (fields);
+  es_free (line);
+  xfree (argv);
+  es_fclose (listing);
+  return err;
+}
+
+
+void
+dump_keyblock (keyblock_t keyblock)
+{
+  keyblock_t kb;
+  pubkey_t pubkey;
+  userid_t uid;
+
+  for (kb = keyblock; kb; kb = kb->next)
+    {
+      log_info ("%s key:\n",
+                 kb->protocol == GNUPG_PROTOCOL_OPENPGP? "OpenPGP":"X.509");
+      for (pubkey = kb->keys; pubkey; pubkey = pubkey->next)
+        {
+          log_info ("  grip: ");
+          if (pubkey->grip_valid)
+            log_printhex (pubkey->grip, KEYGRIP_LEN, NULL);
+          log_printf ("%s\n", pubkey->requested? " (*)":"");
+
+          log_info ("   fpr: ");
+          log_printhex (pubkey->fpr, pubkey->fprlen, "");
+        }
+      for (uid = kb->uids; uid; uid = uid->next)
+        {
+          log_info ("   uid: %s\n", uid->value);
+        }
+    }
+}
+
+
+
+gpg_error_t
+test_get_matching_keys (const char *hexgrip)
+{
+  gpg_error_t err;
+  unsigned char grip[KEYGRIP_LEN];
+  keyblock_t keyblock;
+
+  if (strlen (hexgrip) != 40)
+    {
+      log_error ("error: invalid keygrip\n");
+      return 0;
+    }
+  if (hex2bin (hexgrip, grip, sizeof grip) < 0)
+    {
+      log_error ("error: bad kegrip\n");
+      return 0;
+    }
+  err = get_matching_keys (grip,
+                           (GNUPG_PROTOCOL_OPENPGP | GNUPG_PROTOCOL_CMS),
+                           &keyblock);
+  if (err)
+    {
+      log_error ("get_matching_keys failed: %s\n", gpg_strerror (err));
+      return err;
+    }
+
+  dump_keyblock (keyblock);
+  release_keyblock (keyblock);
+  return 0;
+}
diff --git a/tools/card-tool.h b/tools/card-tool.h
index b1d8662..d502ecb 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -50,6 +50,41 @@ struct
 #define DBG_IPC       (opt.debug & DBG_IPC_VALUE)
 #define DBG_EXTPROG   (opt.debug & DBG_EXTPROG_VALUE)
 
+/* The maximum length of a binary fingerprint.  */
+#define MAX_FINGERPRINT_LEN  32
+
+
+/*
+ * Data structures to store keyblocks (aka certificates).
+ */
+struct pubkey_s
+{
+  struct pubkey_s *next;   /* The next key.  */
+  unsigned char grip[KEYGRIP_LEN];
+  unsigned char fpr[MAX_FINGERPRINT_LEN];
+  unsigned char fprlen;     /* The used length of a FPR.  */
+  unsigned int grip_valid:1;/* The grip is valid.  */
+  unsigned int requested: 1;/* This is the requested grip.  */
+};
+typedef struct pubkey_s *pubkey_t;
+
+struct userid_s
+{
+  struct userid_s *next;
+  char *value;   /* Malloced.  */
+};
+typedef struct userid_s *userid_t;
+
+struct keyblock_s
+{
+  struct keyblock_s *next;  /* Allow to link several keyblocks.  */
+  int protocol;      /* GPGME_PROTOCOL_OPENPGP or _CMS. */
+  pubkey_t keys;     /* The key.  For OpenPGP primary + list of subkeys.  */
+  userid_t uids;     /* The list of user ids.  */
+};
+typedef struct keyblock_s *keyblock_t;
+
+
 
 /* Enumeration of the known card application types. */
 typedef enum
@@ -76,9 +111,9 @@ struct key_attr
   };
 };
 
-/* An object to store information pertaining to a key pair.  This is
- * commonly used as a linked list with all keys known for the current
- * card.  */
+/* An object to store information pertaining to a key pair as stored
+ * on a card.  This is commonly used as a linked list with all keys
+ * known for the current card.  */
 struct key_info_s
 {
   struct key_info_s *next;
@@ -144,6 +179,13 @@ struct card_info_s
 typedef struct card_info_s *card_info_t;
 
 
+/*-- card-tool-keys.c --*/
+void release_keyblock (keyblock_t keyblock);
+gpg_error_t get_matching_keys (const unsigned char *keygrip, int protocol,
+                               keyblock_t *r_keyblock);
+gpg_error_t test_get_matching_keys (const char *hexgrip);
+
+
 /*-- card-tool-misc.c --*/
 key_info_t find_kinfo (card_info_t info, const char *keyref);
 
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index 4f79620..321426b 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -69,6 +69,9 @@ enum cmd_and_opt_values
     oLCctype,
     oLCmessages,
 
+    aTest,
+
+
     oDummy
   };
 
@@ -76,6 +79,7 @@ enum cmd_and_opt_values
 /* The list of commands and options. */
 static ARGPARSE_OPTS opts[] = {
   ARGPARSE_group (300, ("@Commands:\n ")),
+  ARGPARSE_c (aTest, "test", "test command"),
 
   ARGPARSE_group (301, ("@\nOptions:\n ")),
 
@@ -227,6 +231,10 @@ parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
         case oLCctype:     opt.lc_ctype = pargs->r.ret_str; break;
         case oLCmessages:  opt.lc_messages = pargs->r.ret_str; break;
 
+        case aTest:
+          cmd = pargs->r_opt;
+          break;
+
         default: pargs->err = 2; break;
 	}
     }
@@ -292,6 +300,12 @@ main (int argc, char **argv)
   /* Run the selected command.  */
   switch (cmd)
     {
+    case aTest:
+      if (!argc)
+        wrong_args ("--test KEYGRIP");
+      err = test_get_matching_keys (*argv);
+      break;
+
     default:
       interactive_loop ();
       err = 0;
@@ -580,15 +594,25 @@ mem_is_ff (const char *mem, unsigned int memlen)
 

 /* Helper to list a single keyref.  */
 static void
-list_one_kinfo (key_info_t kinfo, estream_t fp)
+list_one_kinfo (key_info_t firstkinfo, key_info_t kinfo, estream_t fp)
 {
-  if (kinfo)
+  gpg_error_t err;
+  keyblock_t keyblock = NULL;
+  keyblock_t kb;
+  pubkey_t pubkey;
+  userid_t uid;
+  key_info_t ki;
+  const char *s;
+
+  if (firstkinfo && kinfo)
     {
       tty_fprintf (fp, " ");
       if (mem_is_zero (kinfo->grip, sizeof kinfo->grip))
-        tty_fprintf (fp, "[none]\n");
-      else
-        print_keygrip (fp, kinfo->grip);
+        {
+          tty_fprintf (fp, "[none]\n");
+          goto leave;
+        }
+      print_keygrip (fp, kinfo->grip);
 
       if (kinfo->fprlen && kinfo->created)
         {
@@ -597,9 +621,63 @@ list_one_kinfo (key_info_t kinfo, estream_t fp)
           tty_fprintf (fp, "      created ....: %s\n",
                        isotimestamp (kinfo->created));
         }
+      err = get_matching_keys (kinfo->grip,
+                               (GNUPG_PROTOCOL_OPENPGP | GNUPG_PROTOCOL_CMS),
+                               &keyblock);
+      if (err)
+        {
+          if (gpg_err_code (err) != GPG_ERR_NO_PUBKEY)
+            tty_fprintf (fp, "      error ......: %s\n", gpg_strerror (err));
+          goto leave;
+        }
+      for (kb = keyblock; kb; kb = kb->next)
+        {
+          tty_fprintf (fp, "      used for ...: %s\n",
+                       kb->protocol == GNUPG_PROTOCOL_OPENPGP? "OpenPGP" :
+                       kb->protocol == GNUPG_PROTOCOL_CMS? "X.509" : "?");
+          pubkey = kb->keys;
+          /* If this is not the primary key print the primary key's
+           * fingerprint or a reference to it.  */
+          if (kb->protocol == GNUPG_PROTOCOL_OPENPGP)
+            {
+              tty_fprintf (fp, "        main key .:");
+              for (ki=firstkinfo; ki; ki = ki->next)
+                if (pubkey->grip_valid
+                    && !memcmp (ki->grip, pubkey->grip, KEYGRIP_LEN))
+                  break;
+              if (ki)
+                {
+                  /* Fixme: Replace mapping by a table lookup.  */
+                  if (!memcmp (kinfo->grip, pubkey->grip, KEYGRIP_LEN))
+                    s = "this";
+                  else if (!strcmp (ki->keyref, "OPENPGP.1"))
+                    s = "Signature key";
+                  else if (!strcmp (ki->keyref, "OPENPGP.2"))
+                    s = "Encryption key";
+                  else if (!strcmp (ki->keyref, "OPENPGP.3"))
+                    s = "Authentication key";
+                  else
+                    s = NULL;
+                  if (s)
+                    tty_fprintf (fp, " <%s>\n", s);
+                  else
+                    tty_fprintf (fp, " <Key %s>\n", ki->keyref);
+                }
+              else
+                print_shax_fpr (fp, pubkey->fpr, pubkey->fprlen);
+            }
+          for (uid = kb->uids; uid; uid = uid->next)
+            {
+              print_string (fp, "        user id ..: ", uid->value);
+            }
+
+        }
     }
   else
     tty_fprintf (fp, " [none]\n");
+
+ leave:
+  release_keyblock (keyblock);
 }
 
 
@@ -620,7 +698,7 @@ list_all_kinfo (card_info_t info, keyinfolabel_t labels, estream_t fp)
         {
           tty_fprintf (fp, "%s", labels[idx].label);
           kinfo = find_kinfo (info, labels[idx].keyref);
-          list_one_kinfo (kinfo, fp);
+          list_one_kinfo (info->kinfo, kinfo, fp);
           if (kinfo)
             kinfo->xflag = 1;
         }
@@ -633,7 +711,7 @@ list_all_kinfo (card_info_t info, keyinfolabel_t labels, estream_t fp)
       for (i=5+strlen (kinfo->keyref); i < 18; i++)
         tty_fprintf (fp, ".");
       tty_fprintf (fp, ":");
-      list_one_kinfo (kinfo, fp);
+      list_one_kinfo (info->kinfo, kinfo, fp);
     }
 }
 

-----------------------------------------------------------------------

Summary of changes:
 common/util.h          |   7 +
 tools/Makefile.am      |   1 +
 tools/card-tool-keys.c | 467 +++++++++++++++++++++++++++++++++++++++++++++++++
 tools/card-tool.h      |  48 ++++-
 tools/gpg-card-tool.c  |  92 +++++++++-
 5 files changed, 605 insertions(+), 10 deletions(-)
 create mode 100644 tools/card-tool-keys.c


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 15:46:01 2019
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 30 Jan 2019 15:46:01 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 08fb910ec866071549b51845630ff4db7e6a93a1
Message-ID: <E1gor7q-0002ds-TB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  08fb910ec866071549b51845630ff4db7e6a93a1 (commit)
      from  a57e222228090e0d5399862cfc83530735a723c9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 08fb910ec866071549b51845630ff4db7e6a93a1
Author: Andre Heinecke <aheinecke at gnupg.org>
Date:   Wed Jan 30 15:44:15 2019 +0100

    swdb: Fix duplicated gpgrt entry
    
    --
    There were both 1.34 and 1.35 listed.

diff --git a/web/swdb.mac b/web/swdb.mac
index 59675e3..61e0cb2 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -126,16 +126,6 @@
 #
 # LIBGPG-ERROR (aka GPGRT)
 #
-#+macro: libgpg_error_ver  1.34
-#+macro: libgpg_error_date 2019-01-16
-#+macro: libgpg_error_size 897k
-#+macro: libgpg_error_sha1 0a3e67e428a2e051a94cabd9fb140bf49fdc13d0
-#+macro: libgpg_error_sha2 0680799dee71b86b2f435efb825391eb040ce2704b057f6bd3dcc47fbc398c81
-#+macro: gpgrt_ver  1.34
-#+macro: gpgrt_date 2019-01-16
-#+macro: gpgrt_size 897k
-#+macro: gpgrt_sha1 0a3e67e428a2e051a94cabd9fb140bf49fdc13d0
-#+macro: gpgrt_sha2 0680799dee71b86b2f435efb825391eb040ce2704b057f6bd3dcc47fbc398c81
 #+macro: libgpg_error_ver  1.35
 #+macro: libgpg_error_date 2019-01-28
 #+macro: libgpg_error_size 896k

-----------------------------------------------------------------------

Summary of changes:
 web/swdb.mac | 10 ----------
 1 file changed, 10 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 17:52:00 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 30 Jan 2019 17:52:00 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-348-g0107984
Message-ID: <E1got5l-00073U-Bm@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  0107984f9f55f84e4842642bceefd2181ec09dab (commit)
      from  833f27a6a7e059e38bccaf360f05e72e4403545a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0107984f9f55f84e4842642bceefd2181ec09dab
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 17:48:41 2019 +0100

    card: Cache the results from gpg and gpgsm.
    
    * tools/card-tool-keys.c (keyblock_cache): New var.
    (release_keyblock): Factor code out to a new do_release_keyblock.  Add
    a cache.
    (flush_keyblock_cache): New.
    (get_matching_keys): Use the cache.
    * tools/gpg-card-tool.c (cmds): Add command "reset".
    (interactive_loop): Implement reset.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/card-tool-keys.c b/tools/card-tool-keys.c
index af2425c..e9edf98 100644
--- a/tools/card-tool-keys.c
+++ b/tools/card-tool-keys.c
@@ -30,9 +30,22 @@
 #include "../common/openpgpdefs.h"
 #include "card-tool.h"
 
-/* Release a keyblocm object.  */
-void
-release_keyblock (keyblock_t keyblock)
+
+/* It is quite common that all keys of an OpenPGP card belong to the
+ * the same OpenPGP keyblock.  To avoid running several queries
+ * despite that we already got the information with the previous
+ * keyblock, we keep a small cache of of previous done queries.  */
+static struct
+{
+  unsigned int lru;
+  keyblock_t keyblock;
+} keyblock_cache[5];
+
+
+
+/* Helper for release_keyblock.  */
+static void
+do_release_keyblock (keyblock_t keyblock)
 {
   pubkey_t pubkey;
   userid_t uid;
@@ -61,6 +74,62 @@ release_keyblock (keyblock_t keyblock)
 }
 
 
+/* Release a keyblock object.  */
+void
+release_keyblock (keyblock_t keyblock)
+{
+  static unsigned int lru_counter;
+  unsigned int lru;
+  int i, lru_idx;
+
+  if (!keyblock)
+    return;
+
+  lru = (unsigned int)(-1);
+  lru_idx = 0;
+  for (i=0; i < DIM (keyblock_cache); i++)
+    {
+      if (!keyblock_cache[i].keyblock)
+        {
+          keyblock_cache[i].keyblock = keyblock;
+          keyblock_cache[i].lru = ++lru_counter;
+          goto leave;
+        }
+      if (keyblock_cache[i].lru < lru)
+        {
+          lru = keyblock_cache[i].lru;
+          lru_idx = i;
+        }
+    }
+
+  /* No free slot.  Replace one. */
+  do_release_keyblock (keyblock_cache[lru_idx].keyblock);
+  keyblock_cache[lru_idx].keyblock = keyblock;
+  keyblock_cache[lru_idx].lru = ++lru_counter;
+
+ leave:
+  if (!lru_counter)
+    {
+      /* Wrapped around.  We simply clear the entire cache. */
+      flush_keyblock_cache ();
+    }
+}
+
+
+/* Flush the enire keyblock cache.  */
+void
+flush_keyblock_cache (void)
+{
+  int i;
+
+  for (i=0; i < DIM (keyblock_cache); i++)
+    {
+      do_release_keyblock (keyblock_cache[i].keyblock);
+      keyblock_cache[i].keyblock = NULL;
+    }
+}
+
+
 
 /* Object to communicate with the status_cb. */
 struct status_cb_s
@@ -127,6 +196,7 @@ get_matching_keys (const unsigned char *keygrip, int protocol,
   char **fields = NULL;
   int nfields;
   int first_seen;
+  int i;
   keyblock_t keyblock_head, *keyblock_tail, kb;
   pubkey_t pubkey, pk;
   size_t n;
@@ -168,6 +238,18 @@ get_matching_keys (const unsigned char *keygrip, int protocol,
   if (protocol != GNUPG_PROTOCOL_OPENPGP && protocol != GNUPG_PROTOCOL_CMS)
     return gpg_error (GPG_ERR_UNSUPPORTED_PROTOCOL);
 
+  /* Try to get it from our cache. */
+  for (i=0; i < DIM (keyblock_cache); i++)
+    for (kb = keyblock_cache[i].keyblock; kb; kb = kb->next)
+      if (kb->protocol == protocol)
+        for (pk = kb->keys; pk; pk = pk->next)
+          if (pk->grip_valid && !memcmp (pk->grip, keygrip, KEYGRIP_LEN))
+            {
+              *r_keyblock = keyblock_cache[i].keyblock;
+              keyblock_cache[i].keyblock = NULL;
+              return 0;
+            }
+
   /* Open a memory stream.  */
   listing = es_fopenmem (0, "w+b");
   if (!listing)
diff --git a/tools/card-tool.h b/tools/card-tool.h
index d502ecb..05d6ea4 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -181,6 +181,7 @@ typedef struct card_info_s *card_info_t;
 
 /*-- card-tool-keys.c --*/
 void release_keyblock (keyblock_t keyblock);
+void flush_keyblock_cache (void);
 gpg_error_t get_matching_keys (const unsigned char *keygrip, int protocol,
                                keyblock_t *r_keyblock);
 gpg_error_t test_get_matching_keys (const char *hexgrip);
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index 321426b..07b8bc6 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -312,6 +312,8 @@ main (int argc, char **argv)
       break;
     }
 
+  flush_keyblock_cache ();
+
   if (err)
     gnupg_status_printf (STATUS_FAILURE, "- %u", err);
   else if (log_get_errorcount (0))
@@ -2639,6 +2641,7 @@ static struct
   { "passwd"  , cmdPASSWD, 0, N_("menu to change or unblock the PIN")},
   { "verify"  , cmdVERIFY, 0, N_("verify the PIN and list all data")},
   { "unblock" , cmdUNBLOCK,0, N_("unblock the PIN using a Reset Code")},
+  { "reset"   , cmdRESET,  0, N_("send a reset to the card daemon")},
   { "factory-reset", cmdFACTORYRESET, 1, N_("destroy all keys and data")},
   { "kdf-setup", cmdKDFSETUP, 1, N_("setup KDF for PIN authentication")},
   { "key-attr", cmdKEYATTR, 1, N_("change the key attribute")},
@@ -2834,6 +2837,7 @@ interactive_loop (void)
                         "Send a RESET to the card daemon.", 0);
           else
             {
+              flush_keyblock_cache ();
               err = scd_apdu (NULL, NULL);
             }
           break;

-----------------------------------------------------------------------

Summary of changes:
 tools/card-tool-keys.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++--
 tools/card-tool.h      |  1 +
 tools/gpg-card-tool.c  |  4 +++
 3 files changed, 90 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 18:18:09 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 30 Jan 2019 18:18:09 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. fb85cfe7f6df8bde8e942d97fb42d93630a7c3c8
Message-ID: <E1gotV4-00067h-95@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  fb85cfe7f6df8bde8e942d97fb42d93630a7c3c8 (commit)
      from  08fb910ec866071549b51845630ff4db7e6a93a1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fb85cfe7f6df8bde8e942d97fb42d93630a7c3c8
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 30 18:17:52 2019 +0100

    swdb: Try to detect duplicate entries

diff --git a/web/Makefile b/web/Makefile
index e53d091..aba48d1 100644
--- a/web/Makefile
+++ b/web/Makefile
@@ -8,11 +8,20 @@ swdb.lst: swdb.mac
 	                    {print $$2, $$3} \
 	    ' swdb.mac >swdb.lst
 
-swdb.lst.sig: swdb.lst
+swdb.lst.sig: swdb.lst signcheck
 	gpg -sbu 0x249B39D24F25E3B6 swdb.lst
 
+signcheck: swdb.lst
+	@set -e; \
+        tmp="$$(awk '$$1~/^.*_ver/{print $$1}' swdb.lst \
+            |sort|uniq -c|sort -nr|head -1|cut -b 1-7)"; \
+	if [ "$$tmp" -ne 1 ]; then \
+	  echo "ERROR: Duplicate version numbers found" >&2; \
+          exit 1; \
+        fi
+
 upload: swdb.lst.sig
 	scp swdb.lst.sig swdb.lst playfair.gnupg.org:/var/www/git/versions.gnupg.org/htdocs/
 	scp swdb.lst.sig swdb.lst webbuilder at trithemius.gnupg.org:/var/www/www/www.gnupg.org/htdocs/
 
-.PHONY: upload all
+.PHONY: upload all signcheck

-----------------------------------------------------------------------

Summary of changes:
 web/Makefile | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 30 19:56:25 2019
From: cvs at cvs.gnupg.org (by Ben McGinnes)
Date: Wed, 30 Jan 2019 19:56:25 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.12.0-128-ge005052
Message-ID: <E1gov2A-0000FR-Of@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  e005052f4d5b29beda2252f8042dbf5728f5e2aa (commit)
      from  2de1e599770cdb129b84302d963f65fdd3ddd2a4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e005052f4d5b29beda2252f8042dbf5728f5e2aa
Author: Ben McGinnes <ben at adversary.org>
Date:   Thu Jan 31 05:52:59 2019 +1100

    python: docs
    
    * Version bump in preparation for whenever GPGME 1.13.0 happens.
    * Ran the post_installer.py for docs preparation again.
    
    Signed-off-by: Ben McGinnes <ben at adversary.org>

diff --git a/lang/python/doc/rst/gpgme-python-howto.rst b/lang/python/doc/rst/gpgme-python-howto.rst
index 5f8bcd5..6f71109 100644
--- a/lang/python/doc/rst/gpgme-python-howto.rst
+++ b/lang/python/doc/rst/gpgme-python-howto.rst
@@ -4,9 +4,9 @@ Introduction
 ============
 
 +-----------------+------------------------------------------+
-| Version:        | 0.1.4                                    |
+| Version:        | 0.1.5                                    |
 +-----------------+------------------------------------------+
-| GPGME Version:  | 1.12.1                                   |
+| GPGME Version:  | 1.13.0                                   |
 +-----------------+------------------------------------------+
 | Author:         | Ben McGinnes <ben at gnupg.org>             |
 +-----------------+------------------------------------------+
diff --git a/lang/python/doc/src/gpgme-python-howto b/lang/python/doc/src/gpgme-python-howto
index c63191b..e2e7e71 100644
--- a/lang/python/doc/src/gpgme-python-howto
+++ b/lang/python/doc/src/gpgme-python-howto
@@ -15,8 +15,8 @@
   :CUSTOM_ID: intro
   :END:
 
-| Version:        | 0.1.4                                    |
-| GPGME Version:  | 1.12.1                                   |
+| Version:        | 0.1.5                                    |
+| GPGME Version:  | 1.13.0                                   |
 | Author:         | Ben McGinnes <ben at gnupg.org>             |
 | Author GPG Key: | DB4724E6FA4286C92B4E55C4321E4E2373590E5D |
 | Language:       | Australian English, British English      |
diff --git a/lang/python/doc/texinfo/gpgme-python-howto.texi b/lang/python/doc/texinfo/gpgme-python-howto.texi
index 9f53aa5..1f31d04 100644
--- a/lang/python/doc/texinfo/gpgme-python-howto.texi
+++ b/lang/python/doc/texinfo/gpgme-python-howto.texi
@@ -174,9 +174,9 @@ Copyright and Licensing
 
 @multitable {aaaaaaaaaaaaaaa} {aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
 @item Version:
- at tab 0.1.4
+ at tab 0.1.5
 @item GPGME Version:
- at tab 1.12.1
+ at tab 1.13.0
 @item Author:
 @tab Ben McGinnes <ben@@gnupg.org>
 @item Author GPG Key:

-----------------------------------------------------------------------

Summary of changes:
 lang/python/doc/rst/gpgme-python-howto.rst      | 4 ++--
 lang/python/doc/src/gpgme-python-howto          | 4 ++--
 lang/python/doc/texinfo/gpgme-python-howto.texi | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 31 16:08:06 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 31 Jan 2019 16:08:06 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-350-gda38325
Message-ID: <E1gpDwm-0004Hl-2F@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  da383257404cde9689bc58259ef3f46e9903bf34 (commit)
       via  1d57450f3e71b198e66e155a8ebbfab452f58ffc (commit)
      from  0107984f9f55f84e4842642bceefd2181ec09dab (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit da383257404cde9689bc58259ef3f46e9903bf34
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 31 16:06:47 2019 +0100

    card: New command 'authenticate'.
    
    * tools/card-tool-misc.c (hex_to_buffer): New.
    * tools/gpg-card-tool.c (get_data_from_file): Change to allow returning
    a string.
    (cmd_authenticate): New.
    (cmds): Add command "authenticate".
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/card-tool-misc.c b/tools/card-tool-misc.c
index 0f5fcc0..06fcb67 100644
--- a/tools/card-tool-misc.c
+++ b/tools/card-tool-misc.c
@@ -42,3 +42,38 @@ find_kinfo (card_info_t info, const char *keyref)
       return kinfo;
   return NULL;
 }
+
+
+/* Convert STRING into a newly allocated buffer while translating the
+ * hex numbers.  Blanks and colons are allowed to separate pairs of
+ * hex digits.  Returns NULL on error or a newly malloced buffer and
+ * its length in LENGTH.  */
+void *
+hex_to_buffer (const char *string, size_t *r_length)
+{
+  unsigned char *buffer;
+  const char *s;
+  size_t n;
+
+  buffer = xtrymalloc (strlen (string)+1);
+  if (!buffer)
+    return NULL;
+  for (s=string, n=0; *s; s++)
+    {
+      if (ascii_isspace (*s) || *s == ':')
+        continue;
+      if (hexdigitp (s) && hexdigitp (s+1))
+        {
+          buffer[n++] = xtoi_2 (s);
+          s++;
+        }
+      else
+        {
+          xfree (buffer);
+          gpg_err_set_errno (EINVAL);
+          return NULL;
+        }
+    }
+  *r_length = n;
+  return buffer;
+}
diff --git a/tools/card-tool.h b/tools/card-tool.h
index 05d6ea4..bea618a 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -189,6 +189,7 @@ gpg_error_t test_get_matching_keys (const char *hexgrip);
 
 /*-- card-tool-misc.c --*/
 key_info_t find_kinfo (card_info_t info, const char *keyref);
+void *hex_to_buffer (const char *string, size_t *r_length);
 
 
 /*-- card-call-scd.c --*/
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index 07b8bc6..3145229 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -326,8 +326,11 @@ main (int argc, char **argv)
 
 /* Read data from file FNAME up to MAX_GET_DATA_FROM_FILE characters.
  * On error return an error code and stores NULL at R_BUFFER; on
- * success returns 0, stpres the number of bytes read at R_BUFLEN and
- * the address of a newly allocated buffer at R_BUFFER. */
+ * success returns 0 and stores the number of bytes read at R_BUFLEN
+ * and the address of a newly allocated buffer at R_BUFFER.  A
+ * complementary nul byte is always appended to the data but not
+ * counted; this allows to pass NULL for R-BUFFER and consider the
+ * returned data as a string. */
 static gpg_error_t
 get_data_from_file (const char *fname, char **r_buffer, size_t *r_buflen)
 {
@@ -337,7 +340,8 @@ get_data_from_file (const char *fname, char **r_buffer, size_t *r_buflen)
   int n;
 
   *r_buffer = NULL;
-  *r_buflen = 0;
+  if (r_buflen)
+    *r_buflen = 0;
 
   fp = es_fopen (fname, "rb");
   if (!fp)
@@ -356,7 +360,7 @@ get_data_from_file (const char *fname, char **r_buffer, size_t *r_buflen)
       return err;
     }
 
-  n = es_fread (data, 1, MAX_GET_DATA_FROM_FILE, fp);
+  n = es_fread (data, 1, MAX_GET_DATA_FROM_FILE - 1, fp);
   es_fclose (fp);
   if (n < 0)
     {
@@ -365,8 +369,11 @@ get_data_from_file (const char *fname, char **r_buffer, size_t *r_buflen)
       xfree (data);
       return err;
     }
+  data[n] = 0;
+
   *r_buffer = data;
-  *r_buflen = n;
+  if (r_buflen)
+    *r_buflen = n;
   return 0;
 }
 
@@ -951,6 +958,73 @@ cmd_verify (card_info_t info, char *argstr)
 }
 
 
+static gpg_error_t
+cmd_authenticate (card_info_t info, char *argstr)
+{
+  gpg_error_t err;
+  int opt_setkey;
+  int opt_raw;
+  char *string = NULL;
+  char *key = NULL;
+  size_t keylen;
+
+  if (!info)
+    return print_help
+      ("AUTHENTICATE [--setkey] [--raw] [< FILE]|KEY\n\n"
+       "Perform a mutual autentication either by reading the key\n"
+       "from FILE or by taking it from the command line.  Without\n"
+       "the option --raw the key is expected to be hex encoded.\n"
+       "To install a new administration key --setkey is used; this\n"
+       "requires a prior authentication with the old key.",
+       APP_TYPE_PIV, 0);
+
+  if (info->apptype != APP_TYPE_PIV)
+    {
+      log_info ("Note: This is a PIV only command.\n");
+      return gpg_error (GPG_ERR_NOT_SUPPORTED);
+    }
+
+  opt_setkey = has_leading_option (argstr, "--setkey");
+  opt_raw = has_leading_option (argstr, "--raw");
+  argstr = skip_options (argstr);
+
+  if (*argstr == '<')  /* Read key from a file. */
+    {
+      for (argstr++; spacep (argstr); argstr++)
+        ;
+      err = get_data_from_file (argstr, &string, NULL);
+      if (err)
+        goto leave;
+    }
+
+  if (opt_raw)
+    {
+      key = string? string : xstrdup (argstr);
+      string = NULL;
+      keylen = strlen (key);
+    }
+  else
+    {
+      key = hex_to_buffer (string? string: argstr, &keylen);
+      if (!key)
+        {
+          err = gpg_error_from_syserror ();
+          goto leave;
+        }
+    }
+  err = scd_setattr (opt_setkey? "SET-ADM-KEY":"AUTH-ADM-KEY", key, keylen);
+
+ leave:
+  if (key)
+    {
+      wipememory (key, keylen);
+      xfree (key);
+    }
+  xfree (string);
+  return err;
+}
+
+
 /* Helper for cmd_name to qyery a part of name.  */
 static char *
 ask_one_name (const char *prompt)
@@ -2610,7 +2684,7 @@ enum cmdids
     cmdNAME, cmdURL, cmdFETCH, cmdLOGIN, cmdLANG, cmdSALUT, cmdCAFPR,
     cmdFORCESIG, cmdGENERATE, cmdPASSWD, cmdPRIVATEDO, cmdWRITECERT,
     cmdREADCERT, cmdUNBLOCK, cmdFACTORYRESET, cmdKDFSETUP,
-    cmdKEYATTR, cmdUIF,
+    cmdKEYATTR, cmdUIF, cmdAUTHENTICATE,
     cmdINVCMD
   };
 
@@ -2641,6 +2715,7 @@ static struct
   { "passwd"  , cmdPASSWD, 0, N_("menu to change or unblock the PIN")},
   { "verify"  , cmdVERIFY, 0, N_("verify the PIN and list all data")},
   { "unblock" , cmdUNBLOCK,0, N_("unblock the PIN using a Reset Code")},
+  { "authenticate",cmdAUTHENTICATE, 0,N_("authenticate to the card")},
   { "reset"   , cmdRESET,  0, N_("send a reset to the card daemon")},
   { "factory-reset", cmdFACTORYRESET, 1, N_("destroy all keys and data")},
   { "kdf-setup", cmdKDFSETUP, 1, N_("setup KDF for PIN authentication")},
@@ -2871,6 +2946,7 @@ interactive_loop (void)
           if (!err)
             redisplay = 1;
           break;
+        case cmdAUTHENTICATE: err = cmd_authenticate (info, argstr); break;
         case cmdNAME:      err = cmd_name (info, argstr); break;
         case cmdURL:       err = cmd_url (info, argstr);  break;
 	case cmdFETCH:     err = cmd_fetch (info);  break;

commit 1d57450f3e71b198e66e155a8ebbfab452f58ffc
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 31 14:26:17 2019 +0100

    scd: Add DES authentication for PIV card.
    
    * scd/app-piv.c (flush_cached_data): New.
    (auth_adm_key): New.
    (set_adm_key): New.
    (do_setattr): New.
    * scd/command.c (MAXLEN_SETATTRDATA): New.
    (cmd_setattr): Add an inquire option.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/scd/app-piv.c b/scd/app-piv.c
index d984e9c..d34ff7d 100644
--- a/scd/app-piv.c
+++ b/scd/app-piv.c
@@ -112,7 +112,7 @@ static struct data_object_s data_objects[] = {
   { 0x5FC122, 0, 0,0, 1, 0,0, 0, "",   "2.16.23", "SM Cert Signer" },
   { 0x5FC123, 0, 3,3, 1, 0,0, 0, "",   "2.16.24", "Pairing Code Ref Data" },
   { 0 }
-  /* Other key reference values without a tag:
+  /* Other key reference values without a data object:
    * "00" Global PIN (not cleared by application switching)
    * "04" PIV Secure Messaging Key
    * "80" PIV Application PIN
@@ -142,7 +142,7 @@ struct app_local_s {
   /* Various flags.  */
   struct
   {
-    unsigned int dummy:1;
+    unsigned int yubikey:1;  /* This is on a Yubikey.  */
   } flags;
 
 };
@@ -266,6 +266,30 @@ get_cached_data (app_t app, int tag,
 }
 
 
+/* Remove data object described by TAG from the cache.  */
+static void
+flush_cached_data (app_t app, int tag)
+{
+  struct cache_s *c, *cprev;
+
+  for (c=app->app_local->cache, cprev=NULL; c; cprev=c, c = c->next)
+    if (c->tag == tag)
+      {
+        if (cprev)
+          cprev->next = c->next;
+        else
+          app->app_local->cache = c->next;
+        xfree (c);
+
+        for (c=app->app_local->cache; c ; c = c->next)
+          {
+            log_assert (c->tag != tag); /* Oops: duplicated entry. */
+          }
+        return;
+      }
+}
+
+
 /* Get the DO identified by TAG from the card in SLOT and return a
  * buffer with its content in RESULT and NBYTES.  The return value is
  * NULL if not found or a pointer which must be used to release the
@@ -552,6 +576,218 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
 }
 
 
+/* Authenticate the card using the Card Application Administration
+ * Key.  (VALUE,VALUELEN) has that 24 byte key.  */
+static gpg_error_t
+auth_adm_key (app_t app, const unsigned char *value, size_t valuelen)
+{
+  gpg_error_t err;
+  unsigned char tmpl[4+24];
+  size_t tmpllen;
+  unsigned char *outdata = NULL;
+  size_t outdatalen;
+  const unsigned char *s;
+  char witness[8];
+  size_t n;
+  gcry_cipher_hd_t cipher = NULL;
+
+  /* Prepare decryption.  */
+  err = gcry_cipher_open (&cipher, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_ECB, 0);
+  if (err)
+    goto leave;
+  err = gcry_cipher_setkey (cipher, value, valuelen);
+  if (err)
+    goto leave;
+
+  /* Request a witness.  */
+  tmpl[0] = 0x7c;
+  tmpl[1] = 0x02;
+  tmpl[2] = 0x80;
+  tmpl[3] = 0;    /* (Empty witness requests a witness.)  */
+  tmpllen = 4;
+  err = iso7816_general_authenticate (app->slot, 0,
+                                      PIV_ALGORITHM_3DES_ECB_0, 0x9B,
+                                      tmpl, tmpllen, 0,
+                                      &outdata, &outdatalen);
+  if (err)
+    goto leave;
+  if (!(outdatalen && *outdata == 0x7c
+        && (s = find_tlv (outdata, outdatalen, 0x80, &n))
+        && n == 8))
+    {
+      err = gpg_error (GPG_ERR_CARD);
+      log_error ("piv: improper witness received\n");
+      goto leave;
+    }
+  err = gcry_cipher_decrypt (cipher, witness, 8, s, 8);
+  if (err)
+    goto leave;
+
+  /* Return decrypted witness and send our challenge.  */
+  tmpl[0] = 0x7c;
+  tmpl[1] = 22;
+  tmpl[2] = 0x80;
+  tmpl[3] = 8;
+  memcpy (tmpl+4, witness, 8);
+  tmpl[12] = 0x81;
+  tmpl[13] = 8;
+  gcry_create_nonce (tmpl+14, 8);
+  tmpl[22] = 0x80;
+  tmpl[23] = 0;
+  tmpllen = 24;
+  xfree (outdata);
+  err = iso7816_general_authenticate (app->slot, 0,
+                                      PIV_ALGORITHM_3DES_ECB_0, 0x9B,
+                                      tmpl, tmpllen, 0,
+                                      &outdata, &outdatalen);
+  if (err)
+    goto leave;
+  if (!(outdatalen && *outdata == 0x7c
+        && (s = find_tlv (outdata, outdatalen, 0x82, &n))
+        && n == 8))
+    {
+      err = gpg_error (GPG_ERR_CARD);
+      log_error ("piv: improper challenge received\n");
+      goto leave;
+    }
+  /* (We reuse the witness buffer.) */
+  err = gcry_cipher_decrypt (cipher, witness, 8, s, 8);
+  if (err)
+    goto leave;
+  if (memcmp (witness, tmpl+14, 8))
+    {
+      err = gpg_error (GPG_ERR_BAD_SIGNATURE);
+      goto leave;
+    }
+
+ leave:
+   xfree (outdata);
+   gcry_cipher_close (cipher);
+   return err;
+}
+
+
+/* Set a new admin key.  */
+static gpg_error_t
+set_adm_key (app_t app, const unsigned char *value, size_t valuelen)
+{
+  gpg_error_t err;
+  unsigned char apdu[8+24];
+  unsigned int sw;
+
+  /* Check whether it is a weak key and that it is of proper length.  */
+  {
+    gcry_cipher_hd_t cipher;
+
+    err = gcry_cipher_open (&cipher, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_ECB, 0);
+    if (!err)
+      {
+        err = gcry_cipher_setkey (cipher, value, valuelen);
+        gcry_cipher_close (cipher);
+      }
+    if (err)
+      goto leave;
+  }
+
+  if (app->app_local->flags.yubikey)
+    {
+      /* This is a Yubikey.  */
+      if (valuelen != 24)
+        {
+          err = gpg_error (GPG_ERR_INV_LENGTH);
+          goto leave;
+        }
+
+      /* We use a proprietary Yubikey command.  */
+      apdu[0] = 0;
+      apdu[1] = 0xff;
+      apdu[2] = 0xff;
+      apdu[3] = 0xff;  /* touch policy: 0xff=never, 0xfe = always.  */
+      apdu[4] = 3 + 24;
+      apdu[5] = PIV_ALGORITHM_3DES_ECB;
+      apdu[6] = 0x9b;
+      apdu[7] = 24;
+      memcpy (apdu+8, value, 24);
+      err = iso7816_apdu_direct (app->slot, apdu, 8+24, 0, &sw, NULL, NULL);
+      wipememory (apdu+8, 24);
+      if (err)
+        log_error ("piv: setting admin key failed; sw=%04x\n", sw);
+    }
+  else
+    err = gpg_error (GPG_ERR_NOT_SUPPORTED);
+
+
+ leave:
+   return err;
+}
+
+
+/* Handle the SETATTR operation. All arguments are already basically
+ * checked. */
+static gpg_error_t
+do_setattr (app_t app, const char *name,
+            gpg_error_t (*pincb)(void*, const char *, char **),
+            void *pincb_arg,
+            const unsigned char *value, size_t valuelen)
+{
+  gpg_error_t err;
+  static struct {
+    const char *name;
+    unsigned short tag;
+    unsigned short flush_tag;  /* The tag which needs to be flushed or 0. */
+    int special;               /* Special mode to use for thus NAME.  */
+  } table[] = {
+    /* Authenticate using the PIV Card Application Administration Key
+     * (0x0B).  Note that Yubico calls this key the "management key"
+     * which we don't do because that term is too similar to "Cert
+     * Management Key" (0x9D).  */
+    { "AUTH-ADM-KEY", 0x0000, 0x0000, 1 },
+    { "SET-ADM-KEY",  0x0000, 0x0000, 2 }
+  };
+  int idx;
+
+  (void)pincb;
+  (void)pincb_arg;
+
+  for (idx=0; (idx < DIM (table)
+               && ascii_strcasecmp (table[idx].name, name)); idx++)
+    ;
+  if (!(idx < DIM (table)))
+    return gpg_error (GPG_ERR_INV_NAME);
+
+  /* Flush the cache before writing it, so that the next get operation
+   * will reread the data from the card and thus get synced in case of
+   * errors (e.g. data truncated by the card). */
+  if (table[idx].tag)
+    flush_cached_data (app, table[idx].flush_tag? table[idx].flush_tag
+                       /* */                    : table[idx].tag);
+
+  switch (table[idx].special)
+    {
+    case 0:
+      err = iso7816_put_data (app->slot, 0, table[idx].tag, value, valuelen);
+      if (err)
+        log_error ("failed to set '%s': %s\n",
+                   table[idx].name, gpg_strerror (err));
+      break;
+
+    case 1:
+      err = auth_adm_key (app, value, valuelen);
+      break;
+
+    case 2:
+      err = set_adm_key (app, value, valuelen);
+      break;
+
+    default:
+      err = gpg_error (GPG_ERR_BUG);
+      break;
+    }
+
+  return err;
+}
+
+
 /* Send the KEYPAIRINFO back.  DOBJ describes the data object carrying
  * the key.  This is used by the LEARN command. */
 static gpg_error_t
@@ -1086,13 +1322,15 @@ do_change_pin (app_t app, ctrl_t ctrl, const char *pwidstr,
 
   char *newpin = NULL;
   char *oldpin = NULL;
-  size_t newpinlen;
-  size_t oldpinlen;
-  const char *newdesc;
-  int pwid;
+  /* size_t newpinlen; */
+  /* size_t oldpinlen; */
+  /* const char *newdesc; */
+  /* int pwid; */
   pininfo_t pininfo;
 
   (void)ctrl;
+  (void)pincb;
+  (void)pincb_arg;
 
   /* The minimum and maximum lengths are enforced by PIV.  */
   memset (&pininfo, 0, sizeof pininfo);
@@ -1416,6 +1654,9 @@ app_select_piv (app_t app)
       goto leave;
     }
 
+  if (app->cardtype && !strcmp (app->cardtype, "yubikey"))
+    app->app_local->flags.yubikey = 1;
+
 
   /* FIXME: Parse the optional and conditional DOs in the APT.  */
 
@@ -1427,7 +1668,7 @@ app_select_piv (app_t app)
   app->fnc.readcert = do_readcert;
   app->fnc.readkey = NULL;
   app->fnc.getattr = do_getattr;
-  /* app->fnc.setattr = do_setattr; */
+  app->fnc.setattr = do_setattr;
   /* app->fnc.writecert = do_writecert; */
   /* app->fnc.writekey = do_writekey; */
   /* app->fnc.genkey = do_genkey; */
diff --git a/scd/command.c b/scd/command.c
index 044831f..fb0ba98 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -55,6 +55,9 @@
 /* Maximum allowed size of certificate data as used in inquiries. */
 #define MAXLEN_CERTDATA 16384
 
+/* Maximum allowed size for "SETATTR --inquire". */
+#define MAXLEN_SETATTRDATA 16384
+
 
 #define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))
 
@@ -926,7 +929,7 @@ cmd_getattr (assuan_context_t ctx, char *line)
 
 
 static const char hlp_setattr[] =
-  "SETATTR <name> <value> \n"
+  "SETATTR [--inquire] <name> <value> \n"
   "\n"
   "This command is used to store data on a smartcard.  The allowed\n"
   "names and values are depend on the currently selected smartcard\n"
@@ -935,6 +938,10 @@ static const char hlp_setattr[] =
   "However, the current implementation assumes that NAME is not\n"
   "escaped; this works as long as no one uses arbitrary escaping.\n"
   "\n"
+  "If the option --inquire is used, VALUE shall not be given; instead\n"
+  "an inquiry using the keyword \"VALUE\" is used to retrieve it.  The\n"
+  "value is in this case considered to be confidential and not logged.\n"
+  "\n"
   "A PIN will be requested for most NAMEs.  See the corresponding\n"
   "setattr function of the actually used application (app-*.c) for\n"
   "details.";
@@ -942,14 +949,18 @@ static gpg_error_t
 cmd_setattr (assuan_context_t ctx, char *orig_line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
-  int rc;
+  gpg_error_t err;
   char *keyword;
   int keywordlen;
   size_t nbytes;
   char *line, *linebuf;
+  int opt_inquire;
 
-  if ((rc = open_card (ctrl)))
-    return rc;
+  opt_inquire = has_option (orig_line, "--inquire");
+  orig_line = skip_options (orig_line);
+
+  if ((err = open_card (ctrl)))
+    return err;
 
   /* We need to use a copy of LINE, because PIN_CB uses the same
      context and thus reuses the Assuan provided LINE. */
@@ -964,20 +975,38 @@ cmd_setattr (assuan_context_t ctx, char *orig_line)
       *line++ = 0;
   while (spacep (line))
     line++;
-  nbytes = percent_plus_unescape_inplace (line, 0);
+  if (opt_inquire)
+    {
+      unsigned char *value;
 
-  rc = app_setattr (ctrl->app_ctx, ctrl, keyword, pin_cb, ctx,
-                    (const unsigned char*)line, nbytes);
-  xfree (linebuf);
+      assuan_begin_confidential (ctx);
+      err = assuan_inquire (ctx, "VALUE", &value, &nbytes, MAXLEN_SETATTRDATA);
+      assuan_end_confidential (ctx);
+      if (!err)
+        {
+          err = app_setattr (ctrl->app_ctx, ctrl, keyword, pin_cb, ctx,
+                             value, nbytes);
+          wipememory (value, nbytes);
+          xfree (value);
+        }
 
-  return rc;
+   }
+  else
+    {
+      nbytes = percent_plus_unescape_inplace (line, 0);
+      err = app_setattr (ctrl->app_ctx, ctrl, keyword, pin_cb, ctx,
+                         (const unsigned char*)line, nbytes);
+    }
+
+  xfree (linebuf);
+  return err;
 }
 
 
 static const char hlp_writecert[] =
   "WRITECERT <hexified_certid>\n"
   "\n"
-  "This command is used to store a certifciate on a smartcard.  The\n"
+  "This command is used to store a certificate on a smartcard.  The\n"
   "allowed certids depend on the currently selected smartcard\n"
   "application. The actual certifciate is requested using the inquiry\n"
   "\"CERTDATA\" and needs to be provided in its raw (e.g. DER) form.\n"

-----------------------------------------------------------------------

Summary of changes:
 scd/app-piv.c          | 255 +++++++++++++++++++++++++++++++++++++++++++++++--
 scd/command.c          |  49 ++++++++--
 tools/card-tool-misc.c |  35 +++++++
 tools/card-tool.h      |   1 +
 tools/gpg-card-tool.c  |  88 +++++++++++++++--
 5 files changed, 405 insertions(+), 23 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 31 18:57:47 2019
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 31 Jan 2019 18:57:47 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.2.7-351-g1c0fa3e
Message-ID: <E1gpGay-0006gs-Bv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  1c0fa3e6f74692d5e9b5f08cda523f0fcec305eb (commit)
      from  da383257404cde9689bc58259ef3f46e9903bf34 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1c0fa3e6f74692d5e9b5f08cda523f0fcec305eb
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 31 18:57:16 2019 +0100

    card: Implement non-interactive mode.
    
    * tools/card-tool.h (opt): Add field 'initialized'.
    * tools/card-call-scd.c (scd_learn): Set it.
    * tools/gpg-card-tool.c (main): Reworked.
    (dispatch_command): New.
    --
    
    This work is not yet finished because most commands need some tweaks
    for non-interactive work.  What you already can do are things like:
    
     $ gpg-card-tool list -- 'auth <oldkey' \
       -- auth --setkey --raw 123456781234567812345678 -- help auth
    
    Which will list the current card, authenticate using a hex encoded key
    from the file "oldkey", set the new admin key to "123...78", and print
    help for the auth command.  Note that the -- acts as a delimiter
    between commands.  To use a double dash as argument to a command the
    entire command must be quoted.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/card-call-scd.c b/tools/card-call-scd.c
index 9a742a7..c51282f 100644
--- a/tools/card-call-scd.c
+++ b/tools/card-call-scd.c
@@ -956,6 +956,8 @@ scd_learn (card_info_t info)
   /* Also try to get some other key attributes.  */
   if (!err)
     {
+      info->initialized = 1;
+
       err = scd_getattr ("KEY-ATTR", info);
       if (gpg_err_code (err) == GPG_ERR_INV_NAME
           || gpg_err_code (err) == GPG_ERR_UNSUPPORTED_OPERATION)
@@ -964,7 +966,6 @@ scd_learn (card_info_t info)
       if (gpg_err_code (err) == GPG_ERR_INV_NAME
           || gpg_err_code (err) == GPG_ERR_UNSUPPORTED_OPERATION)
         err = 0; /* Not implemented or GETATTR not supported.  */
-
     }
 
   if (info == &dummyinfo)
diff --git a/tools/card-tool.h b/tools/card-tool.h
index bea618a..9aca813 100644
--- a/tools/card-tool.h
+++ b/tools/card-tool.h
@@ -27,6 +27,7 @@
 /* We keep all global options in the structure OPT.  */
 struct
 {
+  int interactive;
   int verbose;
   unsigned int debug;
   int quiet;
@@ -137,6 +138,7 @@ typedef struct key_info_s *key_info_t;
  */
 struct card_info_s
 {
+  int initialized;   /* True if a learn command was successful. */
   int error;         /* private. */
   char *reader;      /* Reader information.  */
   char *cardtype;    /* NULL or type of the card.  */
diff --git a/tools/gpg-card-tool.c b/tools/gpg-card-tool.c
index 3145229..243ee55 100644
--- a/tools/gpg-card-tool.c
+++ b/tools/gpg-card-tool.c
@@ -46,7 +46,7 @@
 #define CONTROL_D ('D' - 'A' + 1)
 
 /* Constants to identify the commands and options. */
-enum cmd_and_opt_values
+enum opt_values
   {
     aNull = 0,
 
@@ -69,18 +69,12 @@ enum cmd_and_opt_values
     oLCctype,
     oLCmessages,
 
-    aTest,
-
-
     oDummy
   };
 
 
 /* The list of commands and options. */
 static ARGPARSE_OPTS opts[] = {
-  ARGPARSE_group (300, ("@Commands:\n ")),
-  ARGPARSE_c (aTest, "test", "test command"),
-
   ARGPARSE_group (301, ("@\nOptions:\n ")),
 
   ARGPARSE_s_n (oVerbose, "verbose", ("verbose")),
@@ -133,7 +127,7 @@ typedef struct keyinfolabel_s *keyinfolabel_t;
 
 
 /* Local prototypes.  */
-static void wrong_args (const char *text) GPGRT_ATTR_NORETURN;
+static gpg_error_t dispatch_command (card_info_t info, const char *command);
 static void interactive_loop (void);
 #ifdef HAVE_LIBREADLINE
 static char **command_completion (const char *text, int start, int end);
@@ -157,11 +151,14 @@ my_strusage( int level )
 
     case 1:
     case 40:
-      p = ("Usage: gpg-card-tool [command] [options] [args] (-h for help)");
+      p = ("Usage: gpg-card-tool"
+           " [options] [{[--] command [args]}]  (-h for help)");
       break;
     case 41:
-      p = ("Syntax: gpg-card-tool [command] [options] [args]\n"
-           "Tool to configure cards and tokens\n");
+      p = ("Syntax: gpg-card-tool"
+           " [options] [command [args] {-- command [args]}]\n\n"
+           "Tool to manage cards and tokens.  With a command an interactive\n"
+           "mode is used.  Use command \"help\" to list all commands.");
       break;
 
     default: p = NULL; break;
@@ -171,14 +168,6 @@ my_strusage( int level )
 
 
 static void
-wrong_args (const char *text)
-{
-  es_fprintf (es_stderr, _("usage: %s [options] %s\n"), strusage (11), text);
-  exit (2);
-}
-
-
-static void
 set_opt_session_env (const char *name, const char *value)
 {
   gpg_error_t err;
@@ -192,13 +181,10 @@ set_opt_session_env (const char *name, const char *value)
 
 

 /* Command line parsing.  */
-static enum cmd_and_opt_values
+static void
 parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
 {
-  enum cmd_and_opt_values cmd = 0;
-  int no_more_options = 0;
-
-  while (!no_more_options && optfile_parse (NULL, NULL, NULL, pargs, popts))
+  while (optfile_parse (NULL, NULL, NULL, pargs, popts))
     {
       switch (pargs->r_opt)
         {
@@ -231,15 +217,9 @@ parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
         case oLCctype:     opt.lc_ctype = pargs->r.ret_str; break;
         case oLCmessages:  opt.lc_messages = pargs->r.ret_str; break;
 
-        case aTest:
-          cmd = pargs->r_opt;
-          break;
-
         default: pargs->err = 2; break;
 	}
     }
-
-  return cmd;
 }
 
 
@@ -250,7 +230,9 @@ main (int argc, char **argv)
 {
   gpg_error_t err;
   ARGPARSE_ARGS pargs;
-  enum cmd_and_opt_values cmd;
+  char **command_list = NULL;
+  int cmdidx;
+  char *command;
 
   gnupg_reopen_std ("gpg-card-tool");
   set_strusage (my_strusage);
@@ -276,44 +258,80 @@ main (int argc, char **argv)
   pargs.argc  = &argc;
   pargs.argv  = &argv;
   pargs.flags = ARGPARSE_FLAG_KEEP;
-  cmd = parse_arguments (&pargs, opts);
+  parse_arguments (&pargs, opts);
 
   if (log_get_errorcount (0))
     exit (2);
 
-  /* Print a warning if an argument looks like an option.  */
-  if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
-    {
-      int i;
-
-      for (i=0; i < argc; i++)
-        if (argv[i][0] == '-' && argv[i][1] == '-')
-          log_info (("NOTE: '%s' is not considered an option\n"), argv[i]);
-    }
-
   /* Set defaults for non given options.  */
   if (!opt.gpg_program)
     opt.gpg_program = gnupg_module_name (GNUPG_MODULE_NAME_GPG);
   if (!opt.gpgsm_program)
     opt.gpgsm_program = gnupg_module_name (GNUPG_MODULE_NAME_GPGSM);
 
-  /* Run the selected command.  */
-  switch (cmd)
+  /* Now build the list of commands.  We guess the size of the array
+   * by assuming each item is a complete command.  Obviously this will
+   * be rarely the case, but it is less code to allocate a possible
+   * too large array.  */
+  command_list = xcalloc (argc+1, sizeof *command_list);
+  cmdidx = 0;
+  command = NULL;
+  while (argc)
     {
-    case aTest:
-      if (!argc)
-        wrong_args ("--test KEYGRIP");
-      err = test_get_matching_keys (*argv);
-      break;
+      for ( ; argc && strcmp (*argv, "--"); argc--, argv++)
+        {
+          if (!command)
+            command = xstrdup (*argv);
+          else
+            {
+              char *tmp = xstrconcat (command, " ", *argv, NULL);
+              xfree (command);
+              command = tmp;
+            }
+        }
+      if (argc)
+        { /* Skip the double dash.  */
+          argc--;
+          argv++;
+        }
+      if (command)
+        {
+          command_list[cmdidx++] = command;
+          command = NULL;
+        }
+    }
+  opt.interactive = !cmdidx;
 
-    default:
+  if (opt.interactive)
+    {
       interactive_loop ();
       err = 0;
-      break;
     }
+  else
+    {
+      struct card_info_s info_buffer;
+      card_info_t info = &info_buffer;
 
-  flush_keyblock_cache ();
+      err = 0;
+      for (cmdidx=0; (command = command_list[cmdidx]); cmdidx++)
+        {
+          err = dispatch_command (info, command);
+          if (err)
+            break;
+        }
+      if (gpg_err_code (err) == GPG_ERR_EOF)
+        err = 0; /* This was a "quit".  */
+      else if (command && !opt.quiet)
+        log_info ("stopped at command '%s'\n", command);
+    }
 
+  flush_keyblock_cache ();
+  if (command_list)
+    {
+      for (cmdidx=0; command_list[cmdidx]; cmdidx++)
+        xfree (command_list[cmdidx]);
+      xfree (command_list);
+    }
   if (err)
     gnupg_status_printf (STATUS_FAILURE, "- %u", err);
   else if (log_get_errorcount (0))
@@ -421,22 +439,24 @@ put_data_to_file (const char *fname, const void *buffer, size_t length)
 static gpg_error_t
 print_help (const char *text, ...)
 {
+  estream_t fp;
   va_list arg_ptr;
   int value;
   int any = 0;
 
-  tty_fprintf (NULL, "%s\n", text);
+  fp = opt.interactive? NULL : es_stdout;
+  tty_fprintf (fp, "%s\n", text);
 
   va_start (arg_ptr, text);
   while ((value = va_arg (arg_ptr, int)))
     {
       if (!any)
-        tty_fprintf (NULL, "[Supported by: ");
-      tty_fprintf (NULL, "%s%s", any?", ":"", app_type_string (value));
+        tty_fprintf (fp, "[Supported by: ");
+      tty_fprintf (fp, "%s%s", any?", ":"", app_type_string (value));
       any = 1;
     }
   if (any)
-    tty_fprintf (NULL, "]\n");
+    tty_fprintf (fp, "]\n");
 
   va_end (arg_ptr);
   return 0;
@@ -588,18 +608,6 @@ mem_is_zero (const char *mem, unsigned int memlen)
 }
 
 
-/* Return true if the buffer MEM or length MEMLEN consists only of 0xFF. */
-static int
-mem_is_ff (const char *mem, unsigned int memlen)
-{
-  int i;
-
-  for (i=0; i < memlen && mem[i] == '\xff'; i++)
-    ;
-  return (i == memlen);
-}
-
-
 

 /* Helper to list a single keyref.  */
 static void
@@ -909,7 +917,7 @@ list_piv (card_info_t info, estream_t fp)
 static void
 list_card (card_info_t info)
 {
-  estream_t fp = NULL;
+  estream_t fp = opt.interactive? NULL : es_stdout;
 
   tty_fprintf (fp, "Reader ...........: %s\n",
                info->reader? info->reader : "[none]");
@@ -2716,6 +2724,7 @@ static struct
   { "verify"  , cmdVERIFY, 0, N_("verify the PIN and list all data")},
   { "unblock" , cmdUNBLOCK,0, N_("unblock the PIN using a Reset Code")},
   { "authenticate",cmdAUTHENTICATE, 0,N_("authenticate to the card")},
+  { "auth"    , cmdAUTHENTICATE, 0, NULL },
   { "reset"   , cmdRESET,  0, N_("send a reset to the card daemon")},
   { "factory-reset", cmdFACTORYRESET, 1, N_("destroy all keys and data")},
   { "kdf-setup", cmdKDFSETUP, 1, N_("setup KDF for PIN authentication")},
@@ -2729,7 +2738,169 @@ static struct
 };
 
 
-/* The main loop.  */
+/* The command line command dispatcher.  */
+static gpg_error_t
+dispatch_command (card_info_t info, const char *orig_command)
+{
+  gpg_error_t err = 0;
+  enum cmdids cmd;             /* The command.  */
+  char *command;               /* A malloced copy of ORIG_COMMAND.  */
+  char *argstr;                /* The argument as a string.  */
+  int i;
+  int ignore_error;
+
+  if ((ignore_error = *orig_command == '-'))
+    orig_command++;
+  command = xstrdup (orig_command);
+  argstr = NULL;
+  if ((argstr = strchr (command, ' ')))
+    {
+      *argstr++ = 0;
+      trim_spaces (command);
+      trim_spaces (argstr);
+    }
+
+  for (i=0; cmds[i].name; i++ )
+    if (!ascii_strcasecmp (command, cmds[i].name ))
+      break;
+  cmd = cmds[i].id; /* (If not found this will be cmdINVCMD). */
+
+  /* Make sure we have valid strings for the args.  They are allowed
+   * to be modified and must thus point to a buffer.  */
+  if (!argstr)
+    argstr = command + strlen (command);
+
+  /* For most commands we need to make sure that we have a card.  */
+  if (!info)
+    ;  /* Help mode */
+  else if (!(cmd == cmdNOP || cmd == cmdQUIT || cmd == cmdHELP
+             || cmd == cmdINVCMD)
+           && !info->initialized)
+    {
+      err = scd_learn (info);
+      if (err)
+        {
+          log_error ("Error reading card: %s\n", gpg_strerror (err));
+          goto leave;
+        }
+    }
+
+  switch (cmd)
+    {
+    case cmdNOP:
+      if (!info)
+        print_help ("NOP\n\n"
+                    "Dummy command.", 0);
+      break;
+
+    case cmdQUIT:
+      if (!info)
+        print_help ("QUIT\n\n"
+                    "Stop processing.", 0);
+      else
+        {
+          err = gpg_error (GPG_ERR_EOF);
+          goto leave;
+        }
+      break;
+
+    case cmdHELP:
+      if (!info)
+        print_help ("HELP [command]\n\n"
+                    "Show all commands.  With an argument show help\n"
+                    "for that command.", 0);
+      else if (*argstr)
+        dispatch_command (NULL, argstr);
+      else
+        {
+          es_printf
+            ("List of commands (\"help <command>\" for details):\n");
+          for (i=0; cmds[i].name; i++ )
+            if(cmds[i].desc)
+              es_printf("%-14s %s\n", cmds[i].name, _(cmds[i].desc) );
+          es_printf ("Prefix a command with a dash to ignore its error.\n");
+        }
+      break;
+
+    case cmdLIST:
+      if (!info)
+        print_help ("LIST\n\n"
+                    "Show content of the card.", 0);
+      else
+        {
+          err = scd_learn (info);
+          if (err)
+            log_error ("Error reading card: %s\n", gpg_strerror (err));
+          else
+            list_card (info);
+        }
+      break;
+
+    case cmdRESET:
+      if (!info)
+        print_help ("RESET\n\n"
+                    "Send a RESET to the card daemon.", 0);
+      else
+        {
+          flush_keyblock_cache ();
+          err = scd_apdu (NULL, NULL);
+        }
+      break;
+
+    case cmdADMIN:
+      /* This is a NOP in non-interactive mode.  */
+      break;
+
+    case cmdVERIFY:       err = cmd_verify (info, argstr); break;
+    case cmdAUTHENTICATE: err = cmd_authenticate (info, argstr); break;
+    case cmdNAME:         err = cmd_name (info, argstr); break;
+    case cmdURL:          err = cmd_url (info, argstr);  break;
+    case cmdFETCH:        err = cmd_fetch (info);  break;
+    case cmdLOGIN:        err = cmd_login (info, argstr); break;
+    case cmdLANG:         err = cmd_lang (info, argstr); break;
+    case cmdSALUT:        err = cmd_salut (info, argstr); break;
+    case cmdCAFPR:        err = cmd_cafpr (info, argstr); break;
+    case cmdPRIVATEDO:    err = cmd_privatedo (info, argstr); break;
+    case cmdWRITECERT:    err = cmd_writecert (info, argstr); break;
+    case cmdREADCERT:     err = cmd_readcert (info, argstr); break;
+    case cmdFORCESIG:     err = cmd_forcesig (info); break;
+    case cmdGENERATE:     err = cmd_generate (info); break;
+    case cmdPASSWD:       err = cmd_passwd (info, 1); break;
+    case cmdUNBLOCK:      err = cmd_unblock (info); break;
+    case cmdFACTORYRESET: err = cmd_factoryreset (info); break;
+    case cmdKDFSETUP:     err = cmd_kdfsetup (info, argstr); break;
+    case cmdKEYATTR:      err = cmd_keyattr (info, argstr); break;
+    case cmdUIF:          err = cmd_uif (info, argstr); break;
+
+    case cmdINVCMD:
+    default:
+      log_error (_("Invalid command  (try \"help\")\n"));
+      break;
+    } /* End command switch. */
+
+
+ leave:
+  /* Return GPG_ERR_EOF only if its origin was "quit".  */
+  es_fflush (es_stdout);
+  if (gpg_err_code (err) == GPG_ERR_EOF && cmd != cmdQUIT)
+    err = gpg_error (GPG_ERR_GENERAL);
+  if (err && gpg_err_code (err) != GPG_ERR_EOF)
+    {
+      if (ignore_error)
+        {
+          log_info ("Command '%s' failed: %s\n", command, gpg_strerror (err));
+          err = 0;
+        }
+      else
+        log_error ("Command '%s' failed: %s\n", command, gpg_strerror (err));
+    }
+  xfree (command);
+
+  return err;
+}
+
+
+/* The interactive main loop.  */
 static void
 interactive_loop (void)
 {
@@ -2825,11 +2996,12 @@ interactive_loop (void)
         }
 
       /* Make sure we have valid strings for the args.  They are
-       * allowed to be modifed and must thus point to a buffer.  */
+       * allowed to be modified and must thus point to a buffer.  */
       if (!argstr)
         argstr = answer + strlen (answer);
 
-      if (!(cmd == cmdNOP || cmd == cmdQUIT || cmd == cmdHELP))
+      if (!(cmd == cmdNOP || cmd == cmdQUIT || cmd == cmdHELP
+            || cmd == cmdINVCMD))
         {
           /* If redisplay is set we know that there was an error reading
            * the card.  In this case we force a LIST command to retry.  */

-----------------------------------------------------------------------

Summary of changes:
 tools/card-call-scd.c |   3 +-
 tools/card-tool.h     |   2 +
 tools/gpg-card-tool.c | 316 ++++++++++++++++++++++++++++++++++++++------------
 3 files changed, 248 insertions(+), 73 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 31 20:02:25 2019
From: cvs at cvs.gnupg.org (by Jakub Bogusz)
Date: Thu, 31 Jan 2019 20:02:25 +0100
Subject: [git] GPG-ERROR - branch, master, updated. gpgrt-1.35-2-gd8b6461
Message-ID: <E1gpHbW-0001w9-JF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  d8b64613d992fd3b7bf13eb299db21a307c8bfa1 (commit)
      from  256c602d9becd05d44a64e66e38413b2b60ca70b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d8b64613d992fd3b7bf13eb299db21a307c8bfa1
Author: Jakub Bogusz <qboosh at pld-linux.org>
Date:   Thu Jan 31 20:02:04 2019 +0100

    po: Update Polish translation
    
    --

diff --git a/po/pl.po b/po/pl.po
index aaafb0c..ee7a2f5 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -1,13 +1,13 @@
 # Polish translation for libgpg-error.
 # Copyright (C) 2004, 2005, 2006 Free Software Foundation, Inc.
 # This file is distributed under the same license as the libgpg-error package.
-# Jakub Bogusz <qboosh at pld-linux.org>, 2004-2016.
+# Jakub Bogusz <qboosh at pld-linux.org>, 2004-2018.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: libgpg-error 1.22\n"
+"Project-Id-Version: libgpg-error 1.29\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2018-03-21 19:02+0100\n"
+"PO-Revision-Date: 2018-04-12 19:02+0100\n"
 "Last-Translator: Jakub Bogusz <qboosh at pld-linux.org>\n"
 "Language-Team: Polish <translation-team-pl at lists.sourceforge.net>\n"
 "Language: pl\n"
@@ -727,7 +727,7 @@ msgid "Bad octal character in S-expression"
 msgstr "B??dny znak ?semkowy w S-wyra?eniu"
 
 msgid "All subkeys are expired or revoked"
-msgstr ""
+msgstr "Wszystkie podklucze wygas?y lub zosta?y anulowane"
 
 msgid "Database is corrupted"
 msgstr "Baza danych jest uszkodzona"
@@ -918,104 +918,74 @@ msgstr "B??d parametru IPC"
 msgid "Unknown IPC inquire"
 msgstr "Nieznane zapytanie IPC"
 
-#, fuzzy
-#| msgid "No crypto engine"
 msgid "Crypto engine too old"
-msgstr "Brak silnika kryptograficznego"
+msgstr "Silnik kryptograficzny zbyt stary"
 
 msgid "Screen or window too small"
-msgstr ""
+msgstr "Ekran lub okno zbyt ma?e"
 
 msgid "Screen or window too large"
-msgstr ""
+msgstr "Ekran lub okno zbyt du?e"
 
 msgid "Required environment variable not set"
-msgstr ""
+msgstr "Wymagana zmienna ?rodowiskowa nie jest ustawiona"
 
-#, fuzzy
-#| msgid "Already exists (LDAP)"
 msgid "User ID already exists"
-msgstr "Ju? istnieje (LDAP)"
+msgstr "Identyfikator u?ytkownika ju? istnieje"
 
-#, fuzzy
-#| msgid "Already exists (LDAP)"
 msgid "Name already exists"
-msgstr "Ju? istnieje (LDAP)"
+msgstr "Nazwa ju? istnieje"
 
-#, fuzzy
-#| msgid "Duplicated value"
 msgid "Duplicated name"
-msgstr "Powt?rzona warto??"
+msgstr "Powt?rzona nazwa"
 
-#, fuzzy
-#| msgid "Certificate too young"
 msgid "Object is too young"
-msgstr "Certyfikat zbyt m?ody"
+msgstr "Obiekt zbyt m?ody"
 
-#, fuzzy
-#| msgid "Provided object is too short"
 msgid "Object is too old"
-msgstr "Dostarczony obiekt jest zbyt ma?y"
+msgstr "Obiekt zbyt stary"
 
-#, fuzzy
-#| msgid "Unknown name"
 msgid "Unknown flag"
-msgstr "Nieznana nazwa"
+msgstr "Nieznana flaga"
 
-#, fuzzy
-#| msgid "Invalid operation code"
 msgid "Invalid execution order"
-msgstr "Niepoprawny kod operacji"
+msgstr "B??dna kolejno?? wykonywania"
 
 msgid "Already fetched"
-msgstr ""
+msgstr "Ju? pobrano"
 
 msgid "Try again later"
-msgstr ""
+msgstr "Prosz? spr?bowa? p??niej"
 
-#, fuzzy
-#| msgid "No name"
 msgid "Wrong name"
-msgstr "Brak nazwy"
+msgstr "Z?a nazwa"
 
 msgid "System bug detected"
-msgstr ""
+msgstr "Wykryto b??d systemu"
 
-#, fuzzy
-#| msgid "Unknown system error"
 msgid "Unknown DNS error"
-msgstr "Nieznany b??d systemu"
+msgstr "Nieznany b??d DNS"
 
-#, fuzzy
-#| msgid "Invalid OID string"
 msgid "Invalid DNS section"
-msgstr "Niepoprawny ?a?cuch OID"
+msgstr "B??dna sekcja DNS"
 
-#, fuzzy
-#| msgid "Invalid S-expression"
 msgid "Invalid textual address form"
-msgstr "Niepoprawne S-wyra?enie"
+msgstr "B??dna posta? tekstowa adresu"
 
-#, fuzzy
-#| msgid "Missing issuer certificate"
 msgid "Missing DNS query packet"
-msgstr "Brak certyfikatu wystawcy"
+msgstr "Brak pakietu zapytania DNS"
 
 msgid "Missing DNS answer packet"
-msgstr ""
+msgstr "Brak pakietu odpowiedzi DNS"
 
 msgid "Connection closed in DNS"
-msgstr ""
+msgstr "Po??czenie zamkni?te przez DNS"
 
-#, fuzzy
-#| msgid "Decryption failed"
 msgid "Verification failed in DNS"
-msgstr "Odszyfrowywanie nie powiod?o si?"
+msgstr "Weryfikacja przez DNS nie powiod?a si?"
 
-#, fuzzy
-#| msgid "Timeout"
 msgid "DNS Timeout"
-msgstr "Up?yn?? limit czasu"
+msgstr "Up?yn?? limit czasu DNS"
 
 msgid "General LDAP error"
 msgstr "B??d og?lny LDAP"
@@ -1332,10 +1302,8 @@ msgstr "s?owo kluczowe zbyt d?ugie"
 msgid "missing argument"
 msgstr "brak argumentu"
 
-#, fuzzy
-#| msgid "invalid value\n"
 msgid "invalid argument"
-msgstr "niepoprawna warto??\n"
+msgstr "n??dny argument"
 
 msgid "invalid command"
 msgstr "b??dne polecenie"
@@ -1353,10 +1321,9 @@ msgstr "b??dna opcja"
 msgid "missing argument for option \"%.50s\"\n"
 msgstr "brak argumentu dla opcji ,,%.50s''\n"
 
-#, fuzzy, c-format
-#| msgid "missing argument for option \"%.50s\"\n"
+#, c-format
 msgid "invalid argument for option \"%.50s\"\n"
-msgstr "brak argumentu dla opcji ,,%.50s''\n"
+msgstr "b??dny argumentu dla opcji ,,%.50s''\n"
 
 #, c-format
 msgid "option \"%.50s\" does not expect an argument\n"
@@ -1382,11 +1349,8 @@ msgid "invalid option \"%.50s\"\n"
 msgstr "b??dna opcja ,,%.50s''\n"
 
 msgid "Please report bugs to <https://bugs.gnupg.org>.\n"
-msgstr ""
+msgstr "B??dy prosimy zg?asza? pod <https://bugs.gnupg.org>.\n"
 
 #, c-format
 msgid "warning: could not recognize %s\n"
 msgstr "uwaga: nie rozpoznano %s\n"
-
-#~ msgid "Usage: %s GPG-ERROR [...]\n"
-#~ msgstr "Sk?adnia: %s B??D-GPG [...]\n"

-----------------------------------------------------------------------

Summary of changes:
 po/pl.po | 98 ++++++++++++++++++++--------------------------------------------
 1 file changed, 31 insertions(+), 67 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org